Two malicious versions of the LiteLLM package were published on PyPI for approximately 40 minutes in March, containing credential-stealing malware that targeted cloud keys, SSH keys, Kubernetes tokens, and database passwords. CloudSEK's analysis of approximately 434,000 captured files suggests that over 2,100 organizations may have been exposed to this supply chain attack.
Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
