LiteLLM traces supply chain attack to a GitHub key nobody revoked

A master key left active for 136 days gave an attacker the access needed to poison a LiteLLM release downloaded an estimated 49,000 times LiteLLM has traced its latest supply chain attack to a mistake made months earlier. According to the project’s postmortem, a master key exposed on GitHub was never revoked, and an attacker eventually used it to poison an official software release. The gap between the leak and the payoff was roughly five months. That is a long time for a door to sit unlocked, and it shows that attackers are patient.

Source: Crypto Briefing