A Leaked LiteLLM Master Key Turned Into a Poisoned Python Release

LiteLLM, the maker of a popular gateway for large language models, disclosed on Friday a compromise rooted in an old mistake that everyone believed had long been cleaned up.

The key nobody revoked

On May 27, 2026, a configuration file carrying the master key to a deployment of the Agent Platform — an open-source tool LiteLLM uses to orchestrate agents — was accidentally committed to the public LiteLLM-Labs/lite-harness repository. The slip was spotted quickly, the commit was force-pushed over, and the exposed keys were flagged for revocation. The master key, however, was never actually revoked.

That oversight was exploited on October 10, 2026, by an unknown attacker (operating from 69.48.229.143). Through the Agent Platform they extracted a GitHub CLI OAuth token the service used so self-hosted cloud agents could open pull requests. The token was not scoped down and belonged to an organization owner — granting owner-level access to every repository.

Hijacking the release pipeline

Using throwaway branches, the attacker ran workflows to harvest the GitHub tokens of two more maintainer-level engineers, then deleted those runs. On October 21 they overrode branch protection and repointed the release source from the genuine BerriAI/litellm to a lookalike repository, Berri-AI/litellm.

Normally a release must be kicked off by an authorized engineer and approved from a special account tied to a physical device in the office. But that rule had been temporarily relaxed to allow more frequent bugfix releases, letting any two engineers trigger and approve. The attacker exploited exactly that. LiteLLM notes the intruder could have removed the restriction entirely on their own, but apparently chose not to, likely to avoid detection.

As a result, LiteLLM 1.107.0 landed on PyPI, then on Docker Hub and GHCR. Minutes later the production and staging run records were deleted. Upwind researcher Lidor Machluf flagged the attack; PyPI quarantined the version and the tainted Docker Hub images were removed or repointed to clean ones.

What the malicious package did

Per Socket and Microsoft, the files bundled with 1.107.0 executed automatically whenever Python started — even if an application never imported LiteLLM. The malware combined a credential stealer (tokens for developer tools, clouds, and browsers, plus keys for npm, PyPI, Cargo and other package managers) with a Unix backdoor that fetched and ran attacker-supplied code once an hour. The harvested data was shipped to litellm.dev/healthcheck, a domain registered on October 13.

Making matters worse, the startup files sat outside the LiteLLM application directory, so deleting only the app's files left the malicious components behind. The company is now revoking every token across all internal systems and vendor platforms.

Source: The Hacker News