Telnyx, LiteLLM and Axios: the supply chain crisis
a day ago
- A wave of supply chain attacks targeted popular npm packages (Telnyx, LiteLLM, axios) by injecting trojans to steal sensitive data, exploiting stolen credentials from previous attacks.
- Attackers used compromised developer credentials to publish malicious versions, creating a vicious cycle of infections that amplified the reach of the attack.
- LLMs are suspected to be accelerants, making it easier to find vulnerabilities and build sophisticated exploits, such as hiding code in audio files.
- Current mitigations (short-lived tokens, package delays, staged publishing) are insufficient; they introduce delays or can be bypassed if developer machines are compromised.
- The author proposes shifting desktop and server OSes to a sandboxed model similar to iOS/Android, where each app has limited permissions to reduce the blast impact of attacks.
- Governments should allocate resources to help open source projects adopt sandboxing and other security measures to address the growing threat.