Leaked LiteLLM master key let attacker hijack release pipeline and publish tainted package

This is a new development in a story we reported earlier: Second supply chain attack hits LiteLLM in 2026.

LiteLLM disclosed on Oct. 24, 2026 that an unknown attacker abused a never-revoked master key to take over its release pipeline and publish LiteLLM 1.107.0, a tainted package, to PyPI on Oct. 21, 2026.

LiteLLM published version 1.107.0 to PyPI between 11:39 and 11:40 a.m. UTC on Oct. 21, 2026, and Docker Hub and GHCR images followed at 11:46 a.m. UTC. Production and staging run records were deleted between 11:53 and 11:54 a.m. UTC. Upwind researcher Lidor Machluf reported the supply chain attack at 12:06 p.m. UTC, and PyPI quarantined version 1.107.0 at 1:23 p.m. UTC.

On Oct. 21, 2026 between 10:08 and 11:08 a.m. UTC, the attacker overrode branch protection and altered the release pipeline, so its source was the lookalike repository Berri-AI/litellm rather than BerriAI/litellm. LiteLLM said a release normally needs an authorized engineer plus approval from a special account tied to a physical office device, but the safeguard was relaxed earlier in the week, so any two engineers could trigger and approve a release. The intruder used one token to trigger the release after repointing the deployer to the malicious repository and another token to approve it. LiteLLM maintainers noted the actor could have loosened or removed the restriction themselves because they already held an organization-owner token, and suspect this was not done to evade detection.

Between 10:11 and 10:12 p.m. UTC on Oct. 10, 2026, the attacker committed to throwaway branches in the internal BerriAI/litellm and BerriAI/litellm-auto repositories to run workflows meant to acquire GitHub CLI OAuth tokens from two engineers with maintainer privileges via an attacker-controlled webhook.site endpoint; the runs were deleted minutes later. Karlo Zanki of Socket said Socket recovered two malicious commits that added .github/workflows/cache.yml, the first on Oct. 10, 2026 at 10:11:45 p.m. UTC and the second on Oct. 12. Socket said neither commit reached a branch that still exists; both lived on short-lived branches created, used, and deleted within minutes. Socket said both commits used a legitimate commit as the base, added .github/workflows/cache.yml with the subject ci: bump cache config, ran on every push or tag via on: [push], then deleted the branch.

On Oct. 10, 2026, an unknown operator using IP address 69.48.229[.]143 used the unrevoked master key to enter the Agent Platform. The intruder extracted a GitHub CLI OAuth token that let self-hosted cloud agents file pull requests to GitHub repositories. LiteLLM’s developers said the token was not scoped down and belonged to the organization owner’s account, giving the intruder owner-level rights across all repositories and enabling credential exfiltration.

LiteLLM said the workflows were designed to identify and exfiltrate additional keys and tokens, focusing on upstream inference API tokens, and that the company is working to revoke every token associated with every internal system and vendor platform. Among the stolen material were GitHub tokens and API keys for the Linear workspace, the LiteLLM deployment, and Together AI, together with a GitHub App identifier and signing key, LiteLLM said.

Socket said the Oct. 12 run extended collection to API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian’s secret-scanning tenant. The same run captured Playwright storage state, PostgreSQL database information including connection string, account name, and password, and Redis endpoint address, port, and authentication password. Socket said the two workflows exfiltrated the data to webhook.site/65a42464-3cfa-4b02-a18c-17a6d7b86f37 and webhook.site/4da03473-a3e7-4dc2-a087-9c564b4208e1.

Karlo Zanki of Socket said a GitHub token and GitHub App private key are credentials for the platform hosting the repository, while GITGUARDIAN_API_KEY is a credential for the secret-scanning platform itself giving an attacker visibility into and potential control over alerts. Zanki said E2E_LINEAR_STORAGE_STATE_B64 holds serialized browser session state permitting authenticated access to the associated Linear account without a password or multifactor authentication. Socket’s findings ruled out LiteLLM’s initial hypothesis that the GitHub CLI OAuth tokens were stolen from the logs of an internal LiteLLM deployment, and Oliver Jensen acknowledged that some assumptions later proved inaccurate or incomplete.

Files included with LiteLLM 1.107.0 run automatically when Python starts, even if nothing imports the library, according to multiple reports. One path harvests credentials from developer tools, AI applications, cloud environments, and browsers, while the other runs a Unix background process that fetches and executes attacker-supplied code every hour. The stealer collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens for npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo; the data is compressed and sent to litellm[.]dev/healthcheck using an HTTP POST request, and the domain was registered on Oct. 13, 2026. The Microsoft Security Research team said the files lived outside the application directory, so removing only the application files could leave malicious startup components behind, and starting Python could activate the code even when LiteLLM was never imported.

On May 27, 2026, a configuration file committed to the public LiteLLM-Labs/lite-harness repository contained the master key for a LiteLLM Agent Platform deployment, according to Oliver Jensen and Mateo Wang of LiteLLM. LiteLLM said the error was quickly identified and the commit was force-pushed over, but the master key was never revoked. “On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key” — Oliver Jensen and Mateo Wang.

On March 24, 2026, LiteLLM version 1.82.8 reached PyPI with a malicious .pth file called litellm_init.pth that runs at every Python process startup, and version 1.82.7 was compromised too. LiteLLM has over 40,000 stars on GitHub and is a popular Python library for LLM APIs that is an important dependency in AI tooling. A commit in a LiteLLM maintainer’s forked repository reads teampcp owns BerriAI; TeamPCP is tied to the March 19 compromise of Aqua Security’s Trivy vulnerability scanner and the March 23 compromise of Checkmarx’s KICS GitHub Action, though whether this is genuinely TeamPCP or a copycat is not confirmed.

On May 18, 2026, Forcepoint X-Labs reported that TeamPCP compromised LiteLLM by pushing malicious versions 1.82.7 and 1.82.8 to PyPI, reaching the package through its build pipeline after poisoning Trivy, a vulnerability scanner used in LiteLLM’s CI/CD workflow. Forcepoint said TeamPCP took over Trivy by spoofing legitimate maintainer identities and pushing impersonated commits, then triggered the automated release pipeline to distribute backdoored binaries through GitHub Releases, Docker Hub, and Amazon ECR. Forcepoint said the poisoned Trivy build reached LiteLLM’s CI/CD job, where the malicious binary pulled data from the runner’s memory and took a PYPI_PUBLISH token that let the attackers publish their own LiteLLM releases to PyPI.

Forcepoint said the version 1.82.7 payload lived in proxy_server.py and ran when the LiteLLM proxy started, whereas version 1.82.8 placed a litelllm_init.pth file in site-packages, so the code started with every Python process, no matter whether anything imported LiteLLM. The payload scanned environment variables and config files for OpenAI Group PBC, Anthropic PBC, and Microsoft Azure API keys, along with AWS, Google Cloud, and Azure SDK credentials, and pulled local kubeconfig files and AWS credential files from user home directories. Forcepoint said the payload encrypted the collected data with a 32-byte AES-256-CBC session key derived through PBKDF2, packed into tpcp.tar.gz, and exfiltrated over curl to models.litellm.cloud, an attacker-controlled lookalike of the legitimate LiteLLM domain.

Forcepoint said the malware installed a polling backdoor called Sysmon.py that sleeps for 300 seconds on first run, then checks checkmarx.zone every 50 minutes for instructions, downloads any returned binary to /tmp/pglog, and executes it as a background process. Forcepoint senior researcher Prashant Kumar said LiteLLM acts as a unified gateway to major AI providers, so one compromise exposed OpenAI, Anthropic and Azure credentials at once. Datadog Security Labs linked the same TeamPCP campaign to a second malicious PyPI publication targeting Telnyx’s Python software development kit in March.