Alibaba Cloud Native

Oct 22, 2026 · Cloud Native

LiteLLM Poisoned Twice in 6 Months: How Higress Uses Wasm Sandboxing & Immutable Releases to Contain Supply Chain Attacks

This article dissects the October 2026 LiteLLM 1.107.0 supply chain attack — where stolen GitHub tokens were used to inject malicious build artifacts that stole cloud credentials, SSH keys, and all upstream LLM API keys — and contrasts it with a March 2026 incident. It then demonstrates how Higress confines extension code in a Wasm sandbox with no filesystem, no environment access, no arbitrary network, and no process creation, while enforcing an immutable, digest-pinned release pipeline that prevents floating tags and unreviewed rebuilds.