Unrevoked Credential Exposed in May Enabled Repository Compromise in October. An attacker exploited an unrevoked LiteLLM master key to steal GitHub credentials, bypass release controls and publish a credential-stealing PyPI package downloaded roughly 50,000 times, exposing developer systems, cloud environments and AI provider secrets.
First seen on govinfosecurity.com
Jump to article: www.govinfosecurity.com/exposed-litellm-key-enabled-pypi-supply-chain-attack-a-33211
