LiteLLM GitHub secrets taken 11 days before malicious package release
Original title: Hackers Breached LiteLLM GitHub Repository 11 Days Before Supply Chain Attack
October 10 and 12 workflows posted CI secrets to webhook.site; a key committed May 27 was never revoked.
Socket says attackers ran secret-stealing GitHub Actions workflows in BerriAI/litellm on October 10 and October 12, eleven days before the October 21 release of malicious litellm==1.107.0 packages. Temporary branches were deleted without merging, while the jobs referenced 20 secret names, including provider and infrastructure credentials. LiteLLM traced access to an Agent Platform master key committed on May 27 and later linked a stolen GH_TOKEN to approval of the production release through a lookalike Berri-AI/litellm pipeline. The project locked registries and started revoking credentials.
Unconfirmed: Socket says October 10 is the earliest substantiated activity, not proof of when access began, and workflow success does not confirm secrets were received.
- The October 10 job targeted six secrets, including GH_TOKEN and a GitHub App private key.
- A trailing || true let the job report success even if exfiltration failed.
- On October 21 the attacker published seven malicious PyPI wheels and compromised container images.
- Another stolen maintainer token deleted release workflow records.
- LiteLLM removed all but one trusted GitHub organization member.
Impact: CI and vendor secrets used to publish malicious packages
| Product | Affected |
|---|---|
| BerriAI LiteLLM | litellm==1.107.0 |
- 1.Treat litellm==1.107.0 and the related container images as compromised.
- 2.Rotate secrets named in the October 10 and 12 workflows if they were valid.
- 3.Review GitHub Actions for cache.yml workflows and deleted ci-tmp branches.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | webhook.site | lue Associated Date / Details Exfiltration endpoint hxxps://webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37 October 10, 2026 Exf |
| sha1 | 1a6e3c1e41f1b5c8eeaeeb2ae94bcd95390fa891 | 4e23b23ea09f4ce63a92b07258f5044 October 10, 2026 Git commit 1a6e3c1e41f1b5c8eeaeeb2ae94bcd95390fa891 October 12, 2026 Temporary branch ci-tmp-a351cc Created and |
| sha1 | b69bc36fd4e23b23ea09f4ce63a92b07258f5044 | /cache.yml Workflow used for secret exfiltration Git commit b69bc36fd4e23b23ea09f4ce63a92b07258f5044 October 10, 2026 Git commit 1a6e3c1e41f1b5c8eeaeeb2ae94bcd9 |
| url | https://webhook.site/4da03473-a3e7-4dc2-a087-9c564b4208e1 | 02-a18c-17a6d7b86f37 October 10, 2026 Exfiltration endpoint hxxps://webhook[.]site/4da03473-a3e7-4dc2-a087-9c564b4208e1 October 12, 2026 HTTP request header X-Tag: lm1 October 1 |
| url | https://webhook.site/65a42464-3cfa-4b02-a18c-17a6d7b86f37 | tor / Value Associated Date / Details Exfiltration endpoint hxxps://webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37 October 10, 2026 Exfiltration endpoint hxxps://webhook[.] |
From the original article
3 min read at gbhackers.com
Hackers accessed LiteLLM’s GitHub organization and executed credential-stealing workflows eleven days before the October 21 supply chain attack that distributed malicious litellm==1. 107. 0 packages.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.