Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Automated news aggregation. Headlines and summaries are gathered from public feeds; see our editorial standards for sourcing, corrections, and AI-assist disclosure.
Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more
Key takeaways
- 01Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them.
- 02Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more
Advertisement
About this story
This story was aggregated from The Hacker News. Headlines, summaries, and links are gathered automatically from public RSS feeds for your convenience.
Read the full story →