another day, another supply chain attack.

A breakdown of the LiteLLM supply chain attack where malicious actors compromised the Trivy security scanner's GitHub Action by exploiting a misconfigured pull_request_target workflow. An AI-powered bot stole a privileged personal access token, rewrote mutable version tags to point to malicious commits, and when LiteLLM's CI pipeline ran Trivy, its maintainer credentials were exposed. Attackers used those credentials to push malware into LiteLLM versions 1.27 and 1.28, which exfiltrated SSH keys, API keys, environment variables, git credentials, CI/CD configs, and more from users of the package — including companies like Stripe, Netflix, and Google.