Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Two malicious LiteLLM releases on PyPI in March, active for about 40 minutes, stole credentials from systems that installed them. CloudSEK reports the attackers captured roughly 434,000 files, potentially exposing over 2,100 organizations.
Two malicious LiteLLM releases tied to the Trivy hack sat on PyPI for about 40 minutes in March, carrying code that stole cloud keys, SSH keys, Kubernetes tokens, and database passwords. Threat intelligence firm CloudSEK says a dataset of roughly 434,000 captured files maps potential exposure to more than 2,100 organizations.