LiteLLM

PyPI Supply Chain Attack

Estimated loss

—

VERDICT —UNRATED

Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.

▰ METHOD

Undisclosed

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

SlowMist's CISO 23pds warned on X: "A major supply chain attack has hit LiteLLM (97M monthly downloads) via PyPI. Simply executing pip install litellm allows attackers to steal sensitive data: SSH keys, cloud logins (AWS/GCP/Azure), K8s configs, Git credentials, API keys, shell history, crypto wallets, and DB passwords." Attack method (per SlowMist): PyPI Supply Chain Attack. Reported loss: -.

Primary source

https://x.com/im23pds/status/2036599387267428713 ↗

Sourced from

slowmist

Technical record