LiteLLM supply chain attack traced to leaked master key
The Hacker News reports that LiteLLM, the open source LLM gateway, has disclosed how an attacker published a malicious version of its Python package: a master key leaked in a public GitHub repository in late May was never revoked. The malicious release, version 1.107.0, reached PyPI on October 21, 2026 and was quarantined within hours, according to The Hacker News.
What we know
The account below comes from LiteLLM’s own disclosure as relayed by The Hacker News. We have not independently verified it.
- May 27, 2026: a configuration file was committed to the public LiteLLM-Labs/lite-harness repository. It inadvertently contained the master key for a deployment of the LiteLLM Agent Platform, a tool the company uses to orchestrate agents.
- After the commit: LiteLLM says the error was spotted quickly and the commit was force-pushed over. The exposed keys were identified as needing revocation, but the master key was never revoked.
- October 10, 2026: an unknown attacker used the key to reach the Agent Platform and took a GitHub CLI OAuth token that the service used to file pull requests. LiteLLM says the token was not scoped down and was tied to its GitHub organization owner’s account, giving owner-level access to all repositories in the organization.
- October 10, 2026, around 10:11 to 10:12 p.m. UTC: the attacker committed to throwaway branches on two internal repositories to run workflows that sent OAuth tokens belonging to two maintainer engineers to an attacker-controlled webhook endpoint. The runs were deleted minutes later.
- October 21, 2026, morning UTC: branch protection was overridden and the release pipeline was altered so its source pointed at a lookalike repository, Berri-AI/litellm, rather than BerriAI/litellm.
- October 21, 2026, around 11:40 a.m. UTC: LiteLLM 1.107.0 was published to PyPI. Docker Hub and GHCR images followed at 11:46 a.m., and production and staging run records were deleted shortly after.
- October 21, 2026, 12:06 p.m. UTC: the attack was reported by Upwind researcher Lidor Machluf. PyPI quarantined 1.107.0 at 1:23 p.m., and Docker Hub tags including latest, main-latest and main-stable were removed or repointed to verified clean images later that afternoon.
LiteLLM also says that a normal release has to be started by an authorized engineer and approved by a special account locked to a physical device in its office. According to the report, that restriction was relaxed earlier in the week to allow more frequent releases and bugfix backports, so any two engineers could trigger and approve a release.
Who is affected
Anyone who installed or pulled LiteLLM 1.107.0 from PyPI, Docker Hub or GHCR while it was available is potentially affected. The payload and its behavior were not described in the material available to us, so what the malicious version did on a victim’s system is not disclosed here. LiteLLM’s own GitHub organization and its maintainers’ tokens were also exposed.
Why this matters
This section is our analysis, not new reporting. The incident shows how a single unrevoked secret can outlive the commit that leaked it. Force-pushing over a commit does not make a secret safe, because anyone who copied it in the meantime still has it. The gap between the leak (May) and its use (October) also shows that revocation needs to be verified, not assumed.
The second lesson is the OAuth token. An unscoped token tied to an organization owner turned one platform compromise into control of every repository, and the release pipeline with it. Relaxing a hardware-backed approval step for convenience removed the control that would most likely have stopped the malicious publish.
What has not been confirmed
- The identity of the attacker is unknown, and no group has been named.
- What the malicious package contained or did when run is not publicly stated.
- How many systems installed version 1.107.0 is not disclosed.
Indicators
The only indicators in the source are below, defanged. Treat them as hunting leads, not a complete list.
IP address: 69.48.229[.]143 Exfiltration endpoint type: webhook[.]site Lookalike repository: Berri-AI/litellm (legitimate: BerriAI/litellm)
What to do
- Check every environment, build cache and container image for LiteLLM 1.107.0 and for Docker tags pulled on October 21, 2026. If found, treat the host as compromised and rebuild from a known-clean image.
- Pin dependencies by hash and avoid floating tags such as latest in production images.
- If you ran 1.107.0, rotate every secret that was available to that process, including LLM provider keys, cloud credentials and GitHub tokens.
- Search network and proxy logs for connections to the IP address above and to webhook[.]site endpoints.
- Audit your own repositories for committed secrets. Revoke any leaked key at the provider and confirm in writing that it no longer works, rather than relying on removing the commit.
- Scope CI and agent tokens to the minimum repositories and permissions, never an owner account, and keep two-person, hardware-backed approval on release pipelines.
- Watch for pipeline changes that point a build at a similarly named repository, and alert on branch protection overrides.
