Post #1054128
2026-03-26 04:57 UTC
@brettcannon as far as I understand the developer account was compromised and the bad payload was commited to the repository, so trusted publishing would have created a valid release and you wouldn’t have noticed anything. Did I miss something?
Replies (1)
-
@ancoghlan@mastodon.social 2026-03-26 06:03
@fschulze @brettcannon This particular attack was an exfiltration of a long lived PyPI API key, with packages uploaded from a separate origin. If I understand correctly, there *was* a dev account compromise, but that was of the GitHub Action that was used to perform the key exfiltration (that is, trivy was compromised first, then used to attack LiteLLM et al). Edit to link the specific analysis my understanding is based on: https://futuresearch.ai/blog/litellm-hack-were-you-one-of-the-47000/