LiteLLM hit by *second supply chain attack* this year, users urged to rotate credentials

What happened

LiteLLM, a popular Python library and proxy server that lets developers work with multiple large language model APIs through one interface, was compromised twice in 2026. The October attack saw malicious releases pushed to PyPI and Docker registries that harvested cloud credentials, developer secrets and API keys from users who installed or deployed them ^[1].

Think of it like buying a smart lock that secretly copies your house key the moment you install it. You think you're controlling who gets in, but the lock itself is quietly shipping your key elsewhere.

The earlier March attack compromised data linked to 2,488 corporate domains, including AWS, Samsung, Cisco and Salesforce ^[1]. Users are now urged to rotate all credentials, scan for unauthorised cloud resources and check access logs for signs of compromise.

In short

• Malicious LiteLLM releases to PyPI and Docker harvested cloud logins, secrets and API keys from users ^[1].
• An earlier March 2026 attack compromised data from 2,488 corporate domains ^[1].
• Users should rotate credentials, check for unauthorised resource creation and review access logs ^[1].

Why supply chain attacks work

Developers trust package registries like PyPI and Docker Hub the way you trust a shop to sell you real goods, not counterfeits. When a widely used library is compromised, the malicious code runs with the same permissions as the legitimate version, on thousands of machines, often within minutes of release.

LiteLLM acts as a gateway to commercial AI models, so it handles exactly the kind of credentials attackers want: API keys for OpenAI, Anthropic, Google and AWS, along with cloud access tokens. Once harvested, those credentials let attackers generate model outputs on someone else's bill, exfiltrate data or pivot into other systems.

The March attack showed the scale of exposure: data linked to nearly 2,500 corporate domains, many of them household names. The October attack followed the same pattern, suggesting the first compromise either wasn't fully remediated or the attacker found another way in.

The 24-hour question

Under the Cyber Resilience Act, which has applied since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and serious incidents through ENISA's common platform ^[2]. The early warning is due within 24 hours of becoming aware of the incident, not 24 hours after it suits the organisation.

That clock starts when you know, not when you're ready to say so. It's the same idea as when you lose a bank card: the moment you notice counts, and waiting costs you.

For an open-source project like LiteLLM, the question is what "becoming aware" means when the compromise is discovered by someone else, or when malicious releases are spotted by the community before the maintainers confirm them. The regulation doesn't offer much room: awareness is awareness, whether it comes from your own monitoring or from an external researcher's alert.

What this means for you

If you run LiteLLM, or any tool that handles API keys and cloud credentials, here are three questions to ask this week:

1. Can you show when you became aware of a compromise? The 24-hour reporting rule under the CRA counts from awareness, so a record of when you first learned of an incident, and what you did next, matters. That record needs to exist before someone asks for it.

2. Can you tell which credentials were exposed? Access logs and deployment records show which systems ran a compromised version, and when. If those logs can be quietly edited after the fact, they're harder to rely on during an investigation or when explaining what happened to a supervisor.

3. How do you rotate credentials when you don't know the full scope? The safe move is to rotate everything that could have been on a system running the malicious release. That means API keys, cloud access tokens, database passwords and anything else the compromised code could have reached. It's a lot of work, but less than the work of explaining later why you didn't.

How a witness would work

Sealing detections and responses as they happen

Here, the things to seal are the records you'll need later to show what you knew and when you acted: the first detection note, the decision to escalate, and each report as it is sent.

Sealing takes a fingerprint of each record, not the record itself, so the content stays in your systems. You seal the detection when you first record it, the escalation when you decide to report, and the early warning when you submit it to ENISA's platform. Each seal gives you a witness ID.

If a supervisor or an auditor later asks why the warning went out after 30 hours instead of 24, you can show the sealed detection timestamp and the sealed submission timestamp. Anyone you share those records with can calculate the fingerprints again and check that nothing has changed since the moment you sealed them, even if you're the one keeping the logs.

What it doesn't do: it doesn't show that your detection was fast enough, that the report was complete, or that the response was adequate. It shows timing, not quality.

How it would work

1. Your incident response system seals the first detection note, with the time, when the alert fires.
2. When you decide to escalate, you seal that decision.
3. When the early warning is sent to ENISA, you seal a copy of what was submitted.

Each seal is a call to WitniumChain through the REST API, the SDK or the MCP server. The fingerprint goes out, the data stays with you. To check, you calculate the fingerprint again and compare it with the sealed one. The first 2,000 witnesses a month are free. Read the docs.

What to watch

Under the Cyber Resilience Act, the incident notification goes in three stages: an early warning within 24 hours, a full incident notification within 72 hours, and a final report within a month ^[2]. The clock starts when you become aware, and each deadline is strict.

The regulation applies to manufacturers of products with digital elements, which includes open-source maintainers when they place a product on the market. It doesn't cover medical devices or type-approved vehicles, but it does cover most networked hardware and software ^[2].

Fines for non-compliance can reach €15 million or 2.5 per cent of global annual turnover, whichever is higher ^[2]. Even for projects that don't meet the manufacturer definition, knowing when you knew is still a sensible record to keep.