The Trojan Horse in the AI Stack: How One Tiny Library Exposed the Keys to the Kingdom

This episode explores a critical supply chain attack where malicious code was embedded in legitimate updates of the popular LiteLLM library on PyPI, causing system meltdowns and stealing sensitive credentials like SSH keys and cloud configurations. Listeners will learn how such attacks exploit trusted open-source dependencies to compromise critical infrastructure and why libraries that handle numerous API keys for services like Large Language Models are particularly attractive targets for attackers.