LiteLLM has disclosed that an Agent Platform master key accidentally committed to a public GitHub repository in late May 2026 was never revoked, and an unknown attacker used it in October to push a malicious version of the popular Python package.
According to LiteLLM's Oliver Jensen and Mateo Wang, a configuration file containing the master key was committed on May 27, 2026 to the public LiteLLM-Labs/lite-harness repository. The commit was force-pushed over and the exposed keys flagged for revocation, but the master key itself was not revoked.
The attacker, operating from 69.48.229[.]143, used the key on October 10, 2026 to access the Agent Platform and extract a GitHub CLI OAuth token the service used to let self-hosted cloud agents file pull requests. The token was not scoped down and belonged to the GitHub organization owner's account, giving owner-level access to all repositories and enabling further credential exfiltration.
On October 10, the attacker committed to throwaway branches on internal repositories to run workflows that acquired GitHub CLI OAuth tokens tied to two engineers with maintainer privileges via an attacker-controlled webhook.site endpoint; the runs were deleted minutes later. On October 21, branch protection was overridden and the release pipeline repointed to the lookalike repository Berri-AI/litellm instead of BerriAI/litellm. Version 1.107.0 was published to PyPI at 11:39 a.m. UTC, Docker Hub and GHCR images followed at 11:46 a.m., and production and staging run records were deleted at 11:53 a.m. Upwind researcher Lidor Machluf reported the supply chain attack at 12:06 p.m., PyPI quarantined the version at 1:23 p.m., and Docker Hub tags were removed or repointed to clean images at 2:20 p.m.
LiteLLM said releases normally require an authorized engineer to trigger and a special account locked to a physical device in its office to approve. That restriction was relaxed earlier that week to allow any two engineers to trigger and approve a release, which the attacker used one token for each to exploit.
Socket recovered two malicious commits adding a workflow at .github/workflows/cache.yml, pushed to short-lived branches ci-tmp-a351cc and ci-tmp-4d8517 created and deleted within minutes. Researcher Karlo Zanki said the workflows harvested GitHub tokens and API keys for Linear, LiteLLM deployment and Together AI, plus a GitHub App identifier and signing key; the October 12 run also collected keys for Anthropic, OpenAI, AWS Bedrock, Tavily and GitGuardian, along with Playwright storage state, PostgreSQL and Redis credentials. Data went to two webhook.site endpoints. The findings rule out LiteLLM's initial hypothesis that the OAuth tokens were stolen from internal deployment logs.
Microsoft Security Research said LiteLLM 1.107.0 was engineered to execute automatically when Python starts, even without importing LiteLLM. It carried a credential harvester targeting developer tools, AI applications, cloud environments and browsers, plus a Unix backdoor fetching attacker code hourly. Stolen data was compressed and POSTed to litellm[.]dev/healthcheck, a domain registered October 13, 2026. Because startup files sat outside the application directory, removing only LiteLLM files could leave the malicious components behind. LiteLLM said it is revoking every token tied to its internal systems and vendor platforms.
Source: The Hackers News