1. Sebastien Gioria Oct 28, 2026
   

   Attack

   Trojanized versions hit the OVHcloud CLI and LiteLLM.

   • The attacks used legitimate identities to distribute secret-stealing programs.

   • For OVHcloud, a compromised account replaced the archives and their checksums via the Releases API.

   • For LiteLLM, an exposed master key allowed obtaining an owner's GitHub CLI OAuth token.

   • LiteLLM version 1.107.0 launches a credential stealer at Python startup, even without importing litellm.

   Read the original article OVHcloud CLI et LiteLLM : à deux jours d'écart, les mêmes contrôles absents blog.gioria.org

Back to the weekBack to the month