TLDR Tech / InfoSec
The LiteLLM Supply Chain Attack: A Complete Technical Breakdown Of The AI Ecosystem's Darkest Hour
TeamPCP exploited a `pull_request_target` GitHub Actions misconfiguration in Aqua Security's Trivy scanner on February 27 to steal a privileged PAT, rewrote 75 of 76 mutable version tags in the trivy-action repo to deliver credential-stealing code, and ultimately harvested LiteLLM's PyPI publish token from its unpinned CI/CD pipeline to push malicious versions 1.82.7 and 1.82.8 (97M monthly downloads). The v1.82.8 payload used a `.pth` file in site-packages to trigger a double base64-encoded infostealer on every Python interpreter startup, targeting SSH keys, AWS/GCP/Azure credentials, CI/CD secrets, and crypto wallets, with stolen data AES-256 and RSA-4096 encrypted before exfiltration to `models.litellm.cloud`. Defenders should pin all GitHub Actions to immutable commit hashes, enforce strict lockfiles (Poetry or uv), scope CI/CD tokens to least privilege, and treat any environment that ran Python between 09:00 and 13:30 UTC on March 24 as fully compromised, requiring full credential rotation.
Read the full story