Leaked LiteLLM key enabled malicious PyPI release 1.107.0
LiteLLM said an Agent Platform master key accidentally committed to the public LiteLLM-Labs/lite-harness GitHub repository on May 27, 2026 was used to compromise its release process and publish malicious LiteLLM version 1.107.0 to PyPI on October 21. The key was identified for revocation after the commit was force-pushed, but the master key itself was not revoked.
The attacker used the key on October 10 to access the LiteLLM Agent Platform and extract a GitHub CLI OAuth token. That token was configured to let self-hosted cloud agents open pull requests, but it was not scoped down and was associated with the GitHub organization owner’s account. LiteLLM said this gave the attacker owner-level access across its repositories and enabled further credential collection.
Release controls were redirected to a lookalike repository
On October 21, the attacker overrode branch protection and changed the release pipeline’s source from BerriAI/litellm to the lookalike Berri-AI/litellm. LiteLLM 1.107.0 was published to PyPI at 11:40 a.m. UTC, followed by Docker Hub and GHCR images at 11:46 a.m. UTC.
An Upwind researcher reported the supply-chain attack at 12:06 p.m. UTC. PyPI quarantined version 1.107.0 at 1:23 p.m., while Docker Hub tags including v1.107.0, latest, main-latest and main-stable were removed or repointed to verified clean images at 2:20 p.m. UTC.
LiteLLM said releases would normally require an authorized engineer to initiate the process and approval from a special account locked to a physical device in its office. That restriction had been temporarily relaxed to allow any two engineers to trigger and approve releases during a push for more frequent releases and bug-fix backports. The attacker used one compromised token to trigger the release and another to approve it after redirecting the deployer.
Short-lived workflows targeted more credentials
Socket recovered two malicious commits that added .github/workflows/cache.yml on short-lived branches named ci-tmp-a351cc and ci-tmp-4d8517. Both used the seemingly benign subject “ci: bump cache config,” ran whenever a commit or tag was pushed, and were deleted within minutes.
The workflows harvested GitHub tokens, Linear credentials, LiteLLM deployment credentials, Together AI keys, a GitHub App identifier and signing key, and additional secrets in the October 12 run. Those included keys for Anthropic, OpenAI, AWS Bedrock, Tavily and GitGuardian, as well as Playwright storage state, PostgreSQL connection information and Redis credentials. The information was exfiltrated to attacker-controlled webhook endpoints.
Package could execute at Python startup
Security analyses found that the malicious 1.107.0 package included files designed to execute when Python started, even where an application did not import LiteLLM. Its credential-harvesting component targeted developer tooling, AI applications, cloud environments and web browsers. A Unix-focused backdoor could run in the background and fetch arbitrary attacker code every hour.
The stealer also collected system information, SSH files, Git and GitLab credentials, environment variables, and package-registry tokens. Microsoft Security Research warned that startup files outside the LiteLLM application directory could remain after only the application files were removed. For businesses, the incident makes prompt key revocation, narrowly scoped automation tokens, protected release provenance and checks for persistence essential parts of supply-chain incident response.