Hacked release of AI tool LiteLLM carried a key stealer
A poisoned version 1.107.0 of the open-source AI gateway was online on October 21. LiteLLM says attackers misused three engineers’ GitHub accounts.
LiteLLM connects apps to many AI models, so it often holds their keys. Version 1.107.0 hid malware that steals passwords and keys. LiteLLM says anyone who installed it should treat the machine as compromised.