One key nobody revoked, four months later a malicious PyPI package
Summary On October 21, 2026, LiteLLM's release pipeline published a malicious litellm==1.107.0 to PyPI, Docker Hub and GHCR. The package was signed and shipped through the official process, so every s
#supply-chain#litellm#pypi#github-actions#secret-leak#token-theft#ci-cd-security#release-pipeline#socket#threat-intelligence
Responses
Markdown supported · ⌘↵ to post
No responses yet.