A trong illustration of the risks associated with failing to rotate a potentially exposed key LiteLLM has traced last weeks supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret stealing part of the incident began when someone uploaded a poisoned version 1.107.0 of the popular open source AI gateway to PyPI and its container registries last Wednesday. This compromised version contained an infostealer and a remote...
