negativeSYS.SOURCE: The Hacker News• 2026-10-22T13:58:48+05:30

LiteLLM Investigates GitHub Token Leak Leading to Malicious AI Package Release

#ai #github #malware

LiteLLM disclosed a security breach where threat actors compromised their release pipeline to deploy a malicious Python package (1.107.0) containing a credential stealer and backdoor. The incident occurred on October 21, 2026, around 4:00 a.m., exploiting multiple security controls.

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor.

On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.

Read original article

*** END OF TRANSMISSION ***

> OPTIMIZING MAP POLYGON TRIANGULATION: 3.7M POLYGONS PROCESSED IN 489 MS USING EARSTRIP > COMPROMISED INTERMEDIATE CERTIFICATE AUTHORITY VULNERABILITY CVE-2026-111943 > EXPLORING NON-LLM APPROACHES FOR AI REASONING > LITELLM INVESTIGATES GITHUB TOKEN LEAK LEADING TO MALICIOUS AI PACKAGE RELEASE > CRITICAL REMOTE CODE EXECUTION VULNERABILITY IN NODE.JS BROTLI DECODER ACROSS ALL SUPPORTED VERSIONS > QPACK VULNERABILITIES IN HTTP/3 ENABLE MEMORY AMPLIFICATION ATTACKS > EXPLOIT ATTEMPT TARGETING PHP2SHELL VULNERABILITIES DETECTED FOUR DAYS BEFORE PUBLIC DISCLOSURE > OFFICIAL OPENAI CLI TOOL FOR API INTERACTION > CHINA-LINKED THREAT GROUP STORM-0940 EXPLOITS ARTEX AI FRAMEWORK IN CONNECTWISE SUPPLY CHAIN ATTACK > OPTIMAL O(N LOG N) INTEGER MULTIPLICATION ALGORITHM PROPOSED> OPTIMIZING MAP POLYGON TRIANGULATION: 3.7M POLYGONS PROCESSED IN 489 MS USING EARSTRIP > COMPROMISED INTERMEDIATE CERTIFICATE AUTHORITY VULNERABILITY CVE-2026-111943 > EXPLORING NON-LLM APPROACHES FOR AI REASONING > LITELLM INVESTIGATES GITHUB TOKEN LEAK LEADING TO MALICIOUS AI PACKAGE RELEASE > CRITICAL REMOTE CODE EXECUTION VULNERABILITY IN NODE.JS BROTLI DECODER ACROSS ALL SUPPORTED VERSIONS > QPACK VULNERABILITIES IN HTTP/3 ENABLE MEMORY AMPLIFICATION ATTACKS > EXPLOIT ATTEMPT TARGETING PHP2SHELL VULNERABILITIES DETECTED FOUR DAYS BEFORE PUBLIC DISCLOSURE > OFFICIAL OPENAI CLI TOOL FOR API INTERACTION > CHINA-LINKED THREAT GROUP STORM-0940 EXPLOITS ARTEX AI FRAMEWORK IN CONNECTWISE SUPPLY CHAIN ATTACK > OPTIMAL O(N LOG N) INTEGER MULTIPLICATION ALGORITHM PROPOSED