LiteLLM: an unrevoked key allowed hackers to target users

Open-source AI tool LiteLLM said that a key accidentally exposed in May and left unrevoked allowed an attacker to access LiteLLM’s tooling and take control of all of the project’s GitHub repositories. The attacker then distributed LiteLLM version 1.107.0 through PyPI with credential-harvesting malware. The package was downloaded about 49,000 times.