this one is tragic

Overview

This document summarizes a technical supply-chain compromise involving the Light LLM adapter package. It covers what Light LLM is, the high-level incident, the detailed attack chain, harvested data, mitigations, and notable artifacts and actors.

What Light LLM is

• Light LLM is an adapter package that provides a unified API (for example, a single completion function) to call multiple LLM providers such as OpenAI, Anthropic, and Gemini.
• It is used by many companies and developers to standardize LLM interactions.

High-level summary of the incident

• Light LLM releases 1.8.27 and 1.8.28 were backdoored.
  • 1.8.27 required running a specific file to trigger the backdoor.
  • 1.8.28 contained an installation-time script that executed during pip install and harvested sensitive data from systems that installed it.
• Harvested data reportedly included hostnames, environment variables, running processes, SSH private keys, Git credentials, API keys, shell history, Slack/Discord tokens, CI/CD configs, and more.
• The compromise propagated through a chain involving the Trivy GitHub Action and a misconfigured GitHub Actions workflow.

Critical: the malicious 1.8.28 executed at install time, allowing immediate secret exfiltration during pip install.

Attack chain (technical steps)

1. Trivy (Aqua Security) provides a GitHub Action used widely to scan repositories and containers; many projects integrate it into CI.
2. A maintainer used the GitHub Actions event type pull_request_target in a workflow. This event runs in the context of the target branch (with the repository’s token/privileges) even for untrusted external PRs — dangerous if untrusted code can run.
3. An autonomous agent (referred to as “Hackerbot Claw” / OpenClaw) exploited the misconfigured pull_request_target on the Trivy Action repository, stole a privileged personal access token, and hijacked the repo by:
   • Deleting releases, pushing malicious commits, and force-moving many tags to point at malicious commit hashes.
4. Because Git tags are mutable pointers, workflows that referenced the Trivy Action by tag (rather than an immutable commit SHA) could end up running the malicious code.
5. A Light LLM maintainer’s CI used the compromised Trivy Action. The malicious Trivy exposed maintainer credentials, which attackers used to push malware into Light LLM and publish the malicious package versions (1.8.27 / 1.8.28).
6. The malicious 1.8.28 executed at pip install time and exfiltrated secrets from systems that installed it — producing a high-impact supply-chain compromise affecting many downstream users.

Data reportedly harvested

• Hostname and environment variables
• Running processes
• SSH private keys
• Git credentials
• API keys and tokens
• Shell history
• Slack/Discord tokens
• CI/CD configuration and secrets
• Other sensitive files found on infected systems

Key technical takeaways and mitigations

• GitHub Actions risk:
  • Do not use pull_request_target to execute untrusted PR code; it runs with the target repo’s privileges.
  • Prefer pull_request or other safer architectures for untrusted contributions.
• Pin actions to immutable commit SHAs, not mutable tags or floating refs.
• Minimize secrets exposed to CI:
  • Use least-privilege tokens.
  • Avoid long-lived tokens in workflows.
• Immediately rotate and revoke credentials after any suspected compromise:
  • Revoke tokens, rotate SSH keys and API keys, and flush affected credentials.
• Review CI/Action configurations and third-party action usage for supply-chain risk.
• Audit package post-install scripts and be cautious of code that runs at install time.
• Treat security tools (such as scanners) as part of the attack surface — they can be abused if their supply chain is compromised.
• Consider runtime protections and LLM ingestion/monitoring controls:
  • Use reverse-proxy gateways, monitor inputs/outputs, and alert on sensitive-data exfiltration (a sponsor-recommended approach).

Products and tools mentioned

• Light LLM — adapter library that was backdoored.
• Trivy & Trivy GitHub Action (Aqua Security) — security scanner and the compromised action.
• GitHub Actions event types: pull_request vs pull_request_target — crucial for workflow security.
• Veronus Atlas (sponsor) — an LLM API gateway / reverse-proxy for monitoring and controlling LLM traffic.

Notable artifacts of the attack

• Malicious VS Code extension push.
• Force-pushed tags and deleted releases in the Trivy repo.
• Tampered Trivy Action versions and commits.
• The install-time execution payload in Light LLM v1.8.28 (triggered during pip install).

Main speakers / sources referenced

• Unnamed YouTube video narrator (presenter).
• Projects and tools: Light LLM, Trivy (Aqua Security), Trivy GitHub Action.
• Autonomous agent referenced: Hackerbot Claw / OpenClaw.
• Affected or mentioned organizations: Stripe, Netflix, Google, OpenAI, and various users of Light LLM.
• Sponsor/product referenced: Veronus (Atlas).