Back in March, an attacker group compromised an open source security scanner called Trivy. That scanner was then used by the build system behind LiteLLM, a tool developers use to connect software to AI providers like Anthropic, Gemini and AWS Bedrock. Two poisoned versions of LiteLLM went up on the public Python package repository. They were live for about 40 minutes. Researchers at CloudSEK now count more than 2,500 affected companies and roughly 434,000 build pipelines exposed.
What this means for you
Almost certainly nothing directly. LiteLLM is a developer tool, not something that ends up on a small business brochure site or a local shop's booking system. If your site runs on WordPress, Squarespace, Shopify or a custom build with no AI integration, you were not in the blast radius.
But the shape of this one is worth understanding, because it is the same shape as the incidents that will eventually touch you. Nobody attacked LiteLLM. They attacked a security scanner, which was used by a build system, which published a package, which thousands of companies then downloaded automatically. Three tools deep, from one credential that was never revoked.
Your website is built the same way. It sits on borrowed parts: plugins, themes, payment libraries, analytics scripts, whatever your developer pulled in to save six weeks of work. That is normal and sensible. The risk is not that you use other people's code. The risk is that nobody knows which other people's code you use, or how quickly it updates without anyone looking.
The 40 minutes matters too. Automated systems copy things fast. By the time a bad package is pulled down, it has already spread into caches, laptops and scheduled jobs. Removal is not the same as cleanup.
What to do
Nothing urgent. Next time you speak to whoever maintains your site, ask two things. First: do we have a list of the third-party components this site depends on? Second: are updates applied automatically, or does someone look at them first? Neither answer is wrong on its own. Not knowing the answer is the problem.
If you have recently added any AI feature to your site, ask specifically what it connects through, and whether the access keys have been rotated this year.
Reported by:
