Malicious LiteLLM 1.107.0 published after suspected token leak
Unpinned installs for a few hours on October 21 pulled a credential stealer and an hourly remote-code backdoor.
3
Stories per day · 30 days
2 RSS
10 stories, newest first · one card per story
Stories tagged #credential-stealer
Malicious LiteLLM 1.107.0 ships stealer and backdoor
PyPI quarantined the release and Docker images were removed; users should pin 1.106.2 and rotate exposed credentials.
Compromised LiteLLM 1.107.0 on PyPI installs a stealer and backdoor
All seven wheels run the implants in every Python process; PyPI removed the release, and 1.106.2 plus two release candidates are clean.
Malicious LiteLLM 1.107.0 published with a credential stealer
PyPI and official Docker tags carried the release for about two hours; the RAT dead-drop never delivered a live second stage.
2
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
3
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.
3
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
5
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
TeamPCP planted the SANDCLOCK credential stealer in LiteLLM PyPI releases, exposing credentials across 2,038 repositories at 898 organizations including Microsoft and NVIDIA.
1
TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.