LiteLLM, an open-source AI tool, experienced a supply-chain attack last week, affecting tens of thousands of users. The attack originated from an unrevoked key exposed in May.
The vulnerability or weakness
The attack was facilitated by an unrevoked key exposed in May, which allowed hackers to access internal tools and distribute a version of the tool containing credential-harvesting malware.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations may face financial losses and operational disruptions due to stolen cloud credentials, and could be billed for unauthorized use of AI services.
Industries affected
Tech and AI development firms are primarily affected, as they are the primary users of LiteLLM.
Users affected
Users of the compromised version (1.107.0) should assume their credentials were stolen and change all related access keys and passwords.
