According to Ars Technica, security researchers at CloudSEK and Hudson Rock discovered that malicious code was injected into LiteLLM, an open-source package used across AI development workflows. Attackers uploaded the poisoned version to PyPI (Python's package repository), where developers automatically pulled it. In 40 minutes, the code exfiltrated cloud API keys, repository tokens, SSH credentials, Kubernetes secrets, and AI provider credentials from over 2,500 organizations including Microsoft, Amazon, Cisco, Samsung, and Salesforce.
One compromised package reaches thousands of downstream users instantly. Stolen user passwords are recoverable. Stolen machine credentials open production systems, code repositories, and cloud infrastructure before anyone notices. A 40-minute window was enough to grab terabytes of secrets that can unlock entire supply chains. Trust is distributed in modern software, but the blast radius is not.
The AI boom keeps shipping code faster than companies can secure it. LiteLLM shows where the real vulnerability sits: not in the model, but in the glue code around it. That code lives in public repositories, gets pulled by default, and trusted by default. If your security posture still treats package installs as routine housekeeping, attackers just proved they can grab 40 minutes and walk away with terabytes of credentials.
Filed to the Technology desk · Aug 12