Malicious Code Injected into LiteLLM Open Source AI Package via Supply Chain Attack
The open-source software LiteLLM, designed for generative AI applications, was compromised when malicious code was injected into its official distribution packages. The attack allowed threat actors to steal authentication credentials and execute arbitrary code on affected systems.
Developers disclosed on October 21, 2026, that version LiteLLM 1.107.0 had been altered during the release process. This constituted a software supply chain attack in which attackers gained access to the build pipeline and distributed the tainted software through trusted repositories.
According to researchers at JFrog, seven malicious wheel files were published on the PyPI Python package index. Official container images hosted on Docker Hub and GitHub Container Registry were similarly affected.
The implanted malware implements credential-harvesting routines that target cloud service keys, SSH private keys, browser-stored credentials, and development environment tokens. It can also extract API keys for generative AI services directly from the LiteLLM database.
In addition, the code contains functionality to fetch and execute payloads from remote servers. It leverages Python's automatic execution hooks that run at interpreter startup, allowing the malicious logic to activate even if the LiteLLM application itself is never explicitly imported.
This is the second supply-chain compromise involving LiteLLM in 2026; developers stated that the March incident was unrelated to the current breach.
Related articles
OIDC-Based Push Deployment on VPS Removes SSH Keys from CI While Enforcing Strict Isolation
A new self-hosted deployment system called cd enables secure continuous delivery to single Linux VPS hosts running Docker without storing any long-lived secrets in CI repositories. The architecture relies on short-lived OIDC JWT tokens issued by GitHub Actions or GitLab CI, verified on the target server through JWKS public keys. The server component cdd performs token validation, archive checks, resource-limited builds inside BuildKit, health checks, and automatic rollback on failure. All containers are launched with read-only root filesystems, dropped capabilities, no-new-privileges, and network binding restricted to 127.0.0.1 behind Caddy or Nginx. Administrative control is provided by the cdctl CLI that registers projects, sets RAM/CPU limits, and manages DNS records via Porkbun integration. The entire solution avoids external databases, web panels, and persistent secrets while enforcing one-repository-to-one-application boundaries.
Stolen Credentials Poison cPGuard Update Channel, Turning Security Software into Data Theft Backdoor
Attackers used compromised OPSSHIELD credentials to hijack the cPGuard update distribution network on November 2 at 02:06 UTC, injecting malicious scripts into versions 5.88.12 through 5.88.19. The poisoned updates targeted Linux servers running the security tool, which holds root privileges on hosting provider and cloud infrastructure machines. The script harvested /etc/shadow, /etc/passwd, MariaDB/MySQL root credentials from my.cnf, root shell history containing API tokens, and SSH authorized_keys files before exfiltrating them via the vendor's own infrastructure. A persistent backdoor was also dropped at /var/tmp/.cpg91511_sh. OPSSHIELD detected the intrusion within 12 hours and halted distribution, but confirmed that 32 customer servers had their data accessed. The incident highlights risks of relying on static credentials for security product update pipelines without code signing or behavioral restrictions.
Polymarket Suffers Supply Chain Attack via Compromised DebugBear Monitoring Script
Attackers compromised DNS records of DebugBear, a real user monitoring provider, to inject malicious JavaScript into Polymarket pages. The script extracted wallet data and trading credentials from browser storage, then used the platform's official relayer to execute unauthorized withdrawals totaling approximately $2.7 million across 737 wallets. No smart contract vulnerabilities were exploited; all 985 unauthorized transactions carried valid user signatures. The incident occurred on October 29 and was resolved within an hour after trading was halted, with Polymarket returning $3.9 million including compensation. This attack class matches the 2023 Ledger Connect Kit compromise, highlighting risks from third-party scripts in browser sessions. Polymarket has since committed to stricter CSP policies, script pinning, and sandboxing. The case underscores that browser-based sessions with full API privileges remain a critical trust boundary in crypto platforms.
Approved Stamp: How Container Images Pass Rigorous Security Checks Before Reaching Production
DevSecOps engineer Vitaly Matveev from ecom.tech describes a comprehensive lifecycle process for securing Docker images from build to deployment. The approach combines base image validation through a centralized manifest, Dockerfile checks via Infra Gate, Security Quality Gate results stored as attestations in Harbor, and cryptographic signing only after all checks pass. Kyverno policies in production Kubernetes clusters enforce signature verification and block unsigned or unapproved images. Daily automated scans of base images using EPSS scoring detect new vulnerabilities and notify responsible platform teams. The system ensures traceability from pipeline ID to running pod while maintaining a developer-centric workflow with clear remediation guidance.