LiteLLM supply chain attack traced to master key exposed on GitHub in May

Poisoned package drew about 49,000 downloads before it was quarantined

By LineZotpaper AI staff

Published26 October 2026

Read Time3 min

Illustration: LiteLLM supply chain attack traced to master key exposed on GitHub in May

LiteLLM has traced last week's supply chain attack to a master key it accidentally committed to a public GitHub repository in May, according to a postmortem published Friday. The compromise led to a poisoned version of the popular open source AI gateway being uploaded to PyPI and container registries, where it was downloaded about 49,000 times in less than two hours, security firm Wiz said.

The attack began on May 27, when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. The key belonged to an open source tool LiteLLM uses internally to orchestrate AI agents. Developers spotted the error and removed the exposed commit, but did not revoke the master key.

"On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token," LiteLLM said in Friday's postmortem. "From this point onwards, the threat actor had owner-level access to all repositories in our GitHub."

The stolen GitHub CLI token was particularly dangerous because such tokens are "post-2fa" and do not trigger GitHub's sudo mode authentication, which is normally required for high-impact repository actions. The attacker used it to author malicious commits on other internal repositories, including workflows designed to steal tokens and secrets available during continuous integration. That allowed the attacker to capture further GitHub CLI OAuth tokens belonging to two engineers with maintainer privileges, plus credentials for other internal systems.

"Reviewing the actor's activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens," LiteLLM noted. Because the malicious actions appeared to come from legitimate, credentialed engineers, they raised no suspicion.

The compromised version, 1.107.0, contained an infostealer and a remote access trojan capable of executing arbitrary code. It was designed to collect browser credentials and cookies from Chrome, Firefox, Edge and Safari, along with AWS credentials, Google Cloud Platform service account keys, Azure tokens, and API keys for OpenAI, Anthropic, Cohere and other LLM providers.

LiteLLM is revoking every token associated with every internal system and vendor platform. "This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key," the developers wrote. Anyone who installed and ran version 1.107.0 should assume that any credentials accessible to the affected system may have been stolen, investigate affected systems, change passwords and rotate exposed keys.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

LiteLLM is a widely used open source gateway for AI and cloud services, so a compromise of its build and release pipeline can spread malicious code to many downstream users.
The stolen credentials included API keys for major AI providers, meaning affected users' accounts and cloud resources may be at risk.
The attack shows how a single unrotated exposed key can escalate into owner-level access across an organisation's entire GitHub presence.

Background

LiteLLM is an open source tool commonly used as a proxy and gateway for connecting applications to large language model APIs. The attack followed the classic software supply chain pattern: an attacker gained access to publishing credentials and uploaded a trojanised version to public package registries, where it was briefly available before being quarantined. The incident also highlights how automation tokens, designed to let CI systems act on behalf of developers, can bypass interactive security checks when they fall into the wrong hands.

What to Watch

Whether further reports emerge of credential theft or compromise among users who installed version 1.107.0.
Whether other packages or repositories linked to the attacker's access are identified as the investigation continues.
Whether LiteLLM completes its rotation of all internal and vendor tokens and publishes any additional findings or fixes.

Sources

LiteLLM supply chain attack started with an exposed master key · The Register

Checked

12 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedLiteLLM traced the supply-chain attack to a master key accidentally committed to a public GitHub repository in May.www.theregister.com - Articles: “LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May.”
Partly supportedThe poisoned package received about 49,000 downloads before quarantine, in less than two hours.www.theregister.com - Articles: “While the trojanized package was available on PyPI for less than two hours before being quarantined, it received about 49,000 downloads during that time, according to Wiz.”
Partly supportedThe attack began on May 27, when the configuration file containing the master key was committed.www.theregister.com - Articles: “On Friday, LiteLLM detailed the attack chain behind the compromised release and traced it back to May 27, when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository.”
Partly supportedThe package was uploaded to PyPI and container registries and received about 49,000 downloads, according to Wiz.www.theregister.com - Articles: “The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned version (1.107.0) of the popular open source AI gateway to PyPI and its container registries last Wednesday. While the trojanized package was available on PyPI for less than two hours before being quarantined, it received about 49,000 downloads during that time, according to Wiz.”
SupportedLiteLLM said the threat actor used the key on October 10 to access its Agent Platform and extract a GitHub CLI OAuth token.www.theregister.com - Articles: ““On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token,” according to Friday’s postmortem.”
SupportedLiteLLM said the threat actor then had owner-level access to all its GitHub repositories.www.theregister.com - Articles: ““From this point onwards, the threat actor had owner-level access to all repositories in our GitHub.””
SupportedGitHub CLI tokens are “post-2fa” and do not trigger GitHub’s sudo mode authentication, which is typically required for high-impact repository actions.www.theregister.com - Articles: “This is especially serious because GitHub CLI tokens are “post-2fa,” meaning that they don’t trigger GitHub's sudo mode authentication flows typically required to perform high-impact repository actions.”
SupportedLiteLLM said its review found attempts to identify and exfiltrate additional keys and tokens, especially upstream inference API tokens.www.theregister.com - Articles: ““Reviewing the actor's activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens,” LiteLLM noted.”
SupportedVersion 1.107.0 contained an infostealer and a remote access trojan capable of executing arbitrary code.www.theregister.com - Articles: “This compromised version contained an infostealer and a remote access trojan capable of executing arbitrary code on infected machines.”
SupportedThe malware was designed to collect browser credentials and cookies, cloud credentials and tokens, and API keys for LLM providers.www.theregister.com - Articles: “The infostealers hidden inside the compromised package were designed to hoover up a ton of sensitive information, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials, Google Cloud Platform service account keys and application default credentials, and Microsoft Azure tokens. It also swiped API keys for OpenAI, Anthropic, Cohere, and other LLM providers.”
SupportedLiteLLM is revoking every token associated with every internal system and vendor platform.www.theregister.com - Articles: “In response, LiteLLM’s developers are revoking every token associated with every internal system and vendor platform.”
SupportedAnyone who installed and ran version 1.107.0 should assume accessible credentials may have been stolen, investigate affected systems, change passwords and rotate exposed keys.www.theregister.com - Articles: “So if you installed and ran version 1.107.0, assume any credentials accessible to the affected system may have been stolen. Investigate affected systems, change passwords, and rotate exposed keys.”