TLDR Tech / InfoSec
Delve did the security compliance on LiteLLM, an AI project hit by malware
A credential-harvesting malware slipped into LiteLLM (3.4M daily downloads) via a compromised dependency, propagating across downstream packages and accounts before being caught within hours by a FutureSearch researcher whose machine crashed due to a bug in the malware itself. LiteLLM holds SOC 2 and ISO 27001 certifications issued by Delve, a YC-backed compliance startup that has been separately accused of generating fake audit data and rubber-stamping reports. Mandiant has been brought in for forensic review, with technical findings to be shared with the developer community upon completion.
Read the full story