You depend on open source.
Explore earlier warning around the software in your applications and build pipelines. Start with the evidence, then discuss where it could fit into your security workflow.
Discuss early accessSoftware supply-chain security
A head start on the next software supply-chain threat.
Attackers prepare infrastructure before they use it. Signal investigates the public signals around the open-source software you depend on, giving your team an earlier place to look.
Research preview · Early-access conversations open
From the research desk
001 / LiteLLMIncident analysis · October 2026A recent attack.
A recent attack.
An earlier infrastructure trail.
Our analysis of the October LiteLLM attack identified infrastructure records that predate the malicious release. The finding points to an opportunity for earlier investigation.
Read the short brief (opens in a new tab)A retrospective analytical finding. The supporting evidence, implications, and proposed approach are shared in the full security report.
Request the security reportThe earlier question
What if your team could investigate the attack’s infrastructure before the malicious package arrives?
The approach we’re building
From a public signal
to an informed response.
An earlier layer of defense alongside package scanning, release verification, and your existing security controls.
- 01
Start with your software
Identify the packages and official project infrastructure relevant to your team.
Customer context - 02
Look for early signals
Examine public infrastructure records for activity that warrants a closer look.
Infrastructure research - 03
Assess the evidence
Separate a name match from a supported threat assessment, with sources and uncertainty visible.
Evidence before action - 04
Choose the response
Review the finding with your team and evaluate protection through controls you already operate.
Your policy, your decision
Our published work demonstrates a historical infrastructure signal. Continuous monitoring and integrated protection are the product direction we’re developing with prospective design partners.
Who it’s for
For the teams behind
trusted software.
Others depend on your project.
Review research relevant to your project and help establish which infrastructure is official. Discuss how earlier observations could support your team and ecosystem.
Request the researchAbout Signal
Intelligence
ahead of impact.
Signal Security is developing an earlier view of software supply-chain threats through public infrastructure research.
Our latest analysis examines the October 2026 LiteLLM attack. We’re using those findings to shape how security teams could investigate and respond earlier.
Talk to the teamA few useful answers
Before we talk.
What did Signal find?
Infrastructure evidence associated with the recent LiteLLM attack that predates the malicious release. Our public brief shares the finding; the security report explains the analysis and its implications.
Does a matching domain mean an attack is coming?
No. Legitimate community projects can share a package’s name. A match is a reason to investigate; a threat assessment needs supporting evidence and context.
What is in the security report?
What we found, why it matters, and the approach we’re developing for earlier protection. Request it to discuss the full analysis with our team.
Can we evaluate Signal with our team?
We’re inviting early-access conversations with security teams and open-source maintainers. We’ll discuss your relevant packages, current workflow, and an evaluation scope before agreeing on next steps.
What should we share to start?
Your work email, organization, and whether you would like the research report or an early-access conversation. An initial conversation can start with public package names and official project domains.
Get the full picture
The finding is public.
The full analysis is by request.
Ask for the LiteLLM security report: what we found, what it means, and the approach we’re developing.
Request received.
Your request is saved. Our team will review it before sharing the full report and follow up by email.