LiteLLM supply-chain attack: when *proving* whether logs were touched matters more than keeping them

An unrevoked key, months later

LiteLLM is an open-source tool that sits between AI applications and the large language models they call. It is used by developers to manage API calls, track usage and keep costs down. In May 2025, an API key for the project was accidentally exposed in a public repository. It was not revoked ^[1].

In early 2026, security researchers discovered that attackers had used the key to inject malicious code into the project's repository. The code could steal credentials from developers who installed the compromised versions. Because the changes looked like legitimate maintenance, the attack went undetected for months ^[1].

Supply-chain attacks are a known risk: trust one component and you trust everything it pulls in. The harder question comes later. Once you know something got through, can you show what happened in your own systems during the window when the malicious version was running?

Logs are like receipts

Logs are what tell you who accessed what, when a deployment happened and which version was running. They are like receipts: nobody looks at them until there is a dispute.

The trouble is that receipts do not rewrite themselves. Logs can. If the person investigating an incident has the same access rights as the person who might have caused it, the log is only as trustworthy as the organisation keeping it.

In this case, the key question would be whether LiteLLM's own logs showed unusual access, deployments or credential use during the months the malicious code was in the repository. If those logs could be quietly edited, proving what did or did not happen becomes a matter of who you believe.

What DORA and the Cybersecurity Act say

For financial firms, DORA's technical standard on ICT risk management is clear: logs must be protected against tampering, deletion and unauthorised access ^[2]. The requirement applies to log systems and to the information in them. It has been in force since January 2025.

The Swedish Cybersecurity Act, which implements the EU's NIS2 directive, sets reporting deadlines that start when the organisation became aware of an incident ^[3]. An early warning goes out within 24 hours, an incident report within 72 hours and a final report within a month. The deadlines count from awareness, not from convenience.

Both rules assume you can show what your logs say and when you knew it. If the logs themselves are in question, the timeline falls apart.

In short

• LiteLLM's supply-chain attack went undetected for months because an exposed API key was not revoked and malicious code looked like routine updates ^[1]
• Proving whether logs were edited during an incident is harder than keeping them, especially when the people being questioned could also edit them
• DORA requires logs to be protected against tampering, and the Swedish Cybersecurity Act's reporting deadlines count from when you knew, which means you need to be able to show when you knew ^[2][3]

What this means for you

If your organisation uses open-source components or third-party APIs, three questions are worth asking:

• Could you show which versions of a dependency were deployed, and when?
• If an API key were compromised, would your logs tell you what it was used for, and could you prove the logs had not been edited afterwards?
• When a security incident happens, who can check that the incident timeline and the logs match, without having to trust the person who kept them?

Access controls and monitoring are the foundation. They decide who can do what, and they raise alerts when something looks wrong. A digital witness goes one step further: it makes a change visible even when it is made by someone with the right access.

How a witness would work here

The thing to seal is each log segment as it is written: access logs, deployment events and API usage, for example every few minutes. Sealing takes a fingerprint of the segment, not the content, so the logs themselves never leave your systems.

Anyone investigating an incident can later check that a log segment is exactly what was written at the time it was sealed. If someone with administrator rights quietly edited an entry to cover their tracks, or to make the timeline fit a later narrative, the fingerprint would no longer match.

It does not replace access control, monitoring or backups. It answers a narrower question: has this log been touched since it was sealed?

You seal logs continuously through the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free. Get started at witniumchain.com, and read the technical documentation at witniumchain.com/docs.

How it would work

1. Each log segment is fingerprinted and sealed as it closes, for example every five minutes.
2. The fingerprint goes to WitniumChain; the log stays with you.
3. Months later, when someone questions the timeline, you recalculate the fingerprint. If it matches, nothing has changed.

What to watch

The Cyber Resilience Act's security requirements for products with digital elements apply from 11 December 2027 ^[4]. Among other things, they require logging and monitoring of security-relevant events. For developers of open-source tools that others depend on, showing that a release has not been tampered with will matter as much as keeping it secure in the first place.

Reporting deadlines under the Swedish Cybersecurity Act came into force on 15 January 2026 ^[3]. The 24-hour clock for an early warning starts when you become aware of the incident, which means you need to be able to show when that was.