LiteLLM supply chain attack traced to exposed master key

LiteLLM has traced the supply chain attack that began on 21 October 2026 to a master key accidentally committed to a public GitHub repository in May and never revoked. The poisoned package version 1.107.0 was uploaded to PyPI and container registries on 21 October 2026 and carried an infostealer and a remote access trojan. It was quarantined in under two hours but drew about 49,000 downloads, according to Wiz.

Exposed key opened GitHub access

On 23 October 2026 LiteLLM published a postmortem detailing the attack chain and traced it back to 27 May 2026, when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. The key belonged to an open source tool that LiteLLM uses internally to orchestrate AI agents. Developers spotted the mistake quickly and removed the exposed commit, but they never revoked the master key. On 10 October 2026 the threat actor used that key to reach the LiteLLM Agent Platform and extracted a GitHub CLI OAuth token, which gave owner-level access to every repository in LiteLLM's GitHub. GitHub CLI tokens are post-2fa, so they do not trigger GitHub's sudo mode authentication flows that high-impact repository actions normally require. The token allowed malicious commits into branches of other internal repositories, including CI workflows built to steal any tokens and secrets available during the build. That access in turn yielded GitHub CLI OAuth tokens belonging to two engineers with maintainer privileges, plus tokens for several other internal systems. A review of the actor's activity on those systems showed attempts to identify and exfiltrate additional keys and tokens, focused mainly on upstream inference API tokens.

Poisoned package stole credentials

Version 1.107.0 carried an infostealer and a remote access trojan able to execute arbitrary code on infected machines. The infostealers were built to collect browser credentials and cookies from Chrome, Firefox, Edge and Safari, along with AWS credentials, Google Cloud Platform service account keys and application default credentials, and Microsoft Azure tokens. They also took API keys for OpenAI, Anthropic, Cohere and other LLM providers. Anyone who installed and ran 1.107.0 should assume that any credential reachable from the affected system may have been stolen.

Response and advice

LiteLLM is revoking every token tied to every internal system and vendor platform. Its developers wrote that the incident provided a strong illustration of the risks associated with failing to rotate a potentially exposed key. Anyone who ran 1.107.0 should investigate affected systems, change passwords and rotate exposed keys.

Sources: The Register