LiteLLM supply chain attack began with an unrevoked GitHub master key
Original title: LiteLLM supply chain attack started with an exposed master key
Poisoned release 1.107.0 carried an infostealer and remote access trojan and drew about 49,000 downloads before PyPI quarantined it.
LiteLLM says a master key committed to a public GitHub repository on May 27 was never revoked. On October 10 an attacker used it to enter the LiteLLM Agent Platform, steal a GitHub CLI OAuth token, and gain owner access to the organization's repositories. The attacker then took maintainer tokens and published a trojanized package that also sought cloud and LLM provider secrets. LiteLLM is revoking tokens across internal systems and vendor platforms.
Unconfirmed: The roughly 49,000-download figure is attributed to Wiz, not independently confirmed in the postmortem.
- The exposed key belonged to an internal open source agent-orchestration tool.
- GitHub CLI tokens are post-2FA and skip sudo-mode checks for high-impact actions.
- The malicious build targeted Chrome, Firefox, Edge, and Safari credentials and cookies.
- It also sought AWS, Google Cloud, Azure, OpenAI, Anthropic, and Cohere secrets.
- Anyone who ran that release should treat reachable credentials as stolen.
Impact: Stolen browser, cloud, and LLM provider credentials
| Product | Affected |
|---|---|
| LiteLLM | 1.107.0 |
- 1.If you ran LiteLLM 1.107.0, investigate the host and rotate reachable credentials.
- 2.Change passwords and rotate cloud and LLM provider keys on affected systems.
From the original article
2 min read at theregister.comA 'strong illustration of the risks associated with failing to rotate a potentially exposed key'
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.