Leaked LiteLLM master key used to steal GitHub tokens and publish malicious 1.107.0
Original title: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
An unrevoked Agent Platform key from May let an attacker publish LiteLLM 1.107.0 to PyPI on October 21; PyPI later quarantined it.
LiteLLM said a configuration file committed to the public LiteLLM-Labs/lite-harness repository on May 27, 2026 contained an Agent Platform master key that was never revoked. On October 10 an unknown attacker at 69.48.229[.]143 used it to extract an unscope-limited GitHub CLI OAuth token tied to the organization owner, then harvested maintainer tokens via short-lived workflows. On October 21 the attacker repointed the release pipeline to Berri-AI/litellm and published version 1.107.0 to PyPI, plus Docker Hub and GHCR images. PyPI quarantined 1.107.0 the same day; LiteLLM says it is revoking tokens across internal systems and vendors.
Unconfirmed: The attacker is unidentified, and LiteLLM only suspects the release restriction was left in place to evade detection.
- The master key was force-pushed over in May but not revoked.
- Workflows also targeted Linear, Together AI, Anthropic, OpenAI, AWS Bedrock, Tavily and GitGuardian secrets.
- Upwind researcher Lidor Machluf reported the supply-chain attack at 12:06 p.m. UTC on October 21.
- Docker Hub tags v1.107.0, latest, main-latest and main-stable were removed or repointed.
Impact: Owner-level GitHub access and a malicious PyPI release
| Product | Affected |
|---|---|
| BerriAI LiteLLM | 1.107.0 |
- 1.Treat LiteLLM 1.107.0 from PyPI as malicious and use only verified images.
- 2.Revoke GitHub, inference and related tokens that may have been exposed.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | byGems, and Cargo. The data is then compressed and sent to "litellm[.]dev/healthcheck" using an HTTP POST request. The domain was r |
| domain | webhook.site | neers with maintainer privileges via an attacker-controlled webhook[.]site endpoint. The two runs are deleted minutes later. October |
| ipv4 | 69.48.229.143 | er key." LiteLLM said the unknown attacker (operating from "69.48.229[.]143") used this unrevoked key on October 10, 2026, to gain ac |
From the original article
5 min read at thehackernews.com
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.