TLDR Tech / InfoSec
Trivy, Not LiteLLM Behind the 2,500 Org Compromise
SOCRadar tied 2,085 of 2,188 tracked data exposures to the earlier Trivy compromise. Data collection ran from March 19 to March 24 and showed that malicious LiteLLM packages appeared only for 40 minutes on March 24. The worm stole tokens, keys, and credentials from CI/CD systems, then used developer secrets to poison more packages. Stolen datasets are now being sold on Telegram.
Read the full story