LiteLLM release pipeline hacked to distribute info-stealer malware

Hackers compromised the LiteLLM project's release pipeline, resulting in the publication of malicious PyPI packages and Docker images. The malicious payload was designed to steal credentials, secrets, and environment variables from affected systems. LiteLLM is a popular open-source library used to interact with large language model APIs, making this a significant supply chain attack targeting AI/ML developers. The attack involved tampering with the CI/CD pipeline to inject malicious code into legitimate release artifacts. Victims who installed the compromised package or pulled the malicious Docker images would have had sensitive data exfiltrated. This incident highlights the growing risk of supply chain attacks targeting AI tooling ecosystems.