Artificial Intelligence · Cybersecurity
LiteLLM release pipeline hijacked after key leak
LiteLLM said a master key left in a public GitHub repository in May let an attacker reach its Agent Platform in October, steal credentials and redirect its release pipeline.
- LiteLLM said a configuration file committed on 27 May 2026 to a public repository contained the master key for its Agent Platform.
- The company said the key was not revoked, and an attacker used it on 10 October 2026 to enter the platform and extract a GitHub CLI OAuth token tied to an organisation owner account.
- LiteLLM said the stolen access let the attacker alter the release pipeline and publish version 1.107.0 to PyPI, Docker Hub and GHCR on 21 October.
- Socket said it found two malicious workflow commits on 10 and 12 October, and Microsoft Security Research later said the package could execute when Python started and included both credential theft and a backdoor.
LiteLLM said a configuration file checked into a public repository in May 2026 contained the master key for its Agent Platform. The company said the mistake was spotted and the commit was replaced, but the key was not revoked.
LiteLLM said the attacker used that unrevoked key on 10 October from the address it identified to reach the platform and take a GitHub CLI OAuth token. The company said that token belonged to the organisation owner's account and gave broad access across the repositories.
The company said the attacker then used throwaway branches to run workflows, changed the release setup to point at a lookalike repository, and published version 1.107.0 to PyPI on 21 October. It said Docker Hub and GHCR images were also published, then later removed or repointed, and that the run records were deleted.
Socket said it recovered two malicious workflow commits on 10 and 12 October that were pushed from short-lived branches and then erased. Karlo Zanki said the workflows were built to collect tokens and other secrets, and LiteLLM said the data was sent to webhook.site endpoints before it revised its early view of how the compromise had happened.
LiteLLM and Microsoft Security Research said the package included code that could run when Python started, even if LiteLLM was never imported. They said the package contained a credential stealer and a Unix backdoor, and that the startup files sat outside the application directory.
Named in this story
People
- Oliver Jensen
- co-authored LiteLLM's account of the incident
- Mateo Wang
- co-authored LiteLLM's account of the incident
- Karlo Zanki
- Socket researcher who described the short-lived branch activity
- Lidor Machluf
- Upwind researcher who reported the tainted release
Companies
- GitHub
- hosted the repositories and the OAuth token at issue
- Socket
- published an investigation into the malicious workflows
- Upwind
- reported the supply-chain attack
Organisations
- LiteLLM
- said the leaked key and stolen tokens led to the compromise
- PyPI
- quarantined LiteLLM version 1.107.0
- Microsoft Security Research team
- said the package could run when Python started
Products and systems
- LiteLLM Agent Platform
- the deployment whose master key was exposed and later accessed
- LiteLLM-Labs/lite-harness
- the public repository that held the exposed configuration file
- BerriAI/litellm
- one of the internal repositories used in the malicious workflow activity
- Berri-AI/litellm
- the lookalike repository substituted in the release pipeline
- Docker Hub
- had tags for the release removed or repointed
- GHCR
- hosted container images that were later removed or repointed
- webhook.site
- received exfiltrated data from the workflows
How the source tells it
The piece was a largely straight incident report, with no distinct emotive framing beyond security terminology.
No emotive framing was found in the original.