New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
Socket's Threat Research team found that a malicious secret-exfiltration workflow was already running successfully in the BerriAI/litellm repository on October 10, 2026, eleven days before the release-pipeline attack that published malicious litellm==1.107.0 artifacts, placing observed malicious activity in the repository more than a week before the compromise came to light.
Summary from Socket Blog.
Explained
The technology and terms in this story. Learn more
