New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

Socket BlogOctober 23, 2026AppSec

MentionsDocker GitHub

Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.

Summary from Socket Blog.

Read the full article at Socket Blog

Explained

The technology and terms in this story. Learn more

AttackSupply-chain attackCompromising a vendor, library or update so the attack reaches all of its customers at once.
TechnologyPyPI · Python Package IndexThe package registry for Python libraries.

More in AppSec

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws

Podcast8 minSANS Internet Storm Center StormCast3h agoAppSecVulnerabilitiesCVE-2026-111497

Risky Bulletin: Brotli RCE is wrecking what's left of the internet

Podcast8 minRisky Business News5h agoAppSec

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

Help Net Security7h agoAppSecNetwork

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

The Hacker NewsyesterdayAppSecVulnerabilitiesCVE-2026-111497

Abandoned Popcorn Time app exposed millions of devices to RCE attacks

BleepingComputer2d agoAppSec