TechFlow reports that on March 25, according to 23pds, Chief Information Security Officer at SlowMist Technology, LiteLLM—a Python AI gateway library with a monthly download count of up to 97 million—suffered a PyPI supply-chain attack. Attackers can steal sensitive information from users’ devices simply by executing the command pip install litellm. Sensitive data that may be stolen includes: SSH keys, cloud service credentials (AWS/GCP/Azure), Kubernetes configuration files, Git credentials, API keys stored in environment variables, shell history, cryptocurrency wallet information, and database passwords.
Add to Favorites
Share to Social Media
