LITELLM SUPPLY CHAIN ATTACK HOOVERS UP PASSWORDS AND SECRETS

Summary from the TLDR InfoSec newsletter

Attackers compromised LiteLLM's release process and published version 1.107.0 through PyPI and Docker. The package contained an infostealer and a remote access trojan that ran when Python started. It collected browser, AWS, Google Cloud, Azure, LLM API, SSH, GPG, and shell-history secrets, encrypted them, and sent them to an attacker domain. PyPI and Docker removed the package. Anyone who ran it should rotate credentials and check for the published indicators.