6 min read
Incident Reports On October 21, 2026, malicious LiteLLM 1.107.0 wheels and Docker images carried a startup-hook credential stealer and a remote code loader. Timeline, IOCs and response steps.
llm api keys
6 min read
Research A Wake Forest University empirical study found 282 of 444 iOS AI apps expose exploitable LLM credentials through network traffic. Three months after responsible disclosure, 72% remained vulnerable.
4 min read
Threat Actors Microsoft attributes the Mastra AI npm supply chain attack to Sapphire Sleet, a North Korean state actor: 144 packages backdoored via a hijacked contributor account, targeting LLM API keys, cloud credentials, and cryptocurrency wallets.