Act
active
LiteLLM Supply Chain Compromise: Leaked Key Enabled Malicious Package Push
- Engineer — Act: Confirmed supply-chain compromise of a widely-used Python LLM-integration package (LiteLLM 1.107.0). Audit your dependency tree for that version, inspect CI/CD build logs for exposure since May 27, 2026, and rotate any credentials or tokens accessible to LiteLLM in your pipelines.
- SOC/IR — Act: Active supply-chain compromise with a measurable exposure window starting May 27, 2026. Sweep deployed environments for LiteLLM 1.107.0, hunt for anomalous outbound connections or credential-access events attributable to Python runtime activity during the exposure period, and check GitHub token usage logs for unexpected access.
- Leader — Act: A popular AI/LLM integration package was weaponized via a leaked master key — a systemic supply-chain event. Confirm whether LiteLLM is in your software inventory or vendor stack, assess exposure across the May 27–disclosure window, and brief leadership if any internal pipelines may have run the compromised version.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.