LITELLM confirmed that a master key was accidentally published to a public GitHub repository on 27 May 2026, exposing a deployment of the LiteLLM Agent Platform. An unknown attacker used the unrevoked master key on 10 October 2026 to access the Agent Platform and extract a GitHub CLI OAuth token that allowed self‑hosted cloud agents to file pull requests.
The token was not scoped down and belonged to the organization owner, enabling owner‑level access across the organisation’s repositories and facilitating further credential exfiltration.
The attack chain began with malicious activity tied to two briefly active GitHub webhook workflows discovered in October. In particular, two commits created short‑lived branches and introduced a workflow designed to harvest tokens and API keys, exfiltrating them via two webhook endpoints.
The attacker then leveraged an authorised token to trigger and approve a release as LiteLLM began publishing a malicious PyPI package, LiteLLM version 1.107.0, on 21 October 2026, with Docker Hub and GHCR images released soon after. Production and staging run records were later deleted, and by 12:06 UTC on 21 October a supply‑chain attack was reported, followed by PyPI quarantining version 1.107.0. Subsequent remediation involved revoking tokens associated with internal systems and vendor platforms, and removing or verifying affected Docker tags.
The malicious package is described as automatically executing on Python start, even without LiteLLM import, and contains a credential‑harvesting module plus a Unix backdoor. It collects system, environment, and credentials for multiple tooling ecosystems and exfiltrates data to a dedicated site. LiteLLM says it is revoking all associated tokens and reinforcing release controls to prevent recurrence.