Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Unrevoked LiteLLM key enabled poisoned PyPI release 1.107.0

4 sources · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

An unrevoked May master key let attackers publish malicious LiteLLM 1.107.0 on October 21; PyPI quarantined it after about 49,000 downloads.

LiteLLM said an Agent Platform master key committed on May 27, 2026, and never revoked, let an attacker enter its GitHub organization. On October 10 and 12 the attacker ran short-lived workflows that referenced provider and infrastructure secrets and stole maintainer tokens. On October 21 the attacker published litellm 1.107.0 to PyPI plus container images; PyPI quarantined the package the same day after about two hours and roughly 49,000 downloads. The Record, citing Microsoft, says the malware ran on every Python startup, and that stolen AWS logins were tested within about four and a half hours. LiteLLM is revoking credentials and told anyone who installed 1.107.0 online to assume secrets were stolen.

Key facts
  • The Hacker News says the May 27 key was force-pushed over but never revoked.
  • Socket says the October 10 job targeted GH_TOKEN and a GitHub App private key.
  • The Hacker News attributes access to IP 69.48.229.143 and an owner OAuth token.
  • October 21 release also compromised Docker Hub and GHCR container images.
  • Upwind researcher Lidor Machluf reported the attack at 12:06 p.m. UTC October 21.
  • The Record says this is LiteLLM’s second PyPI supply-chain compromise this year.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. May 27, 2026Agent Platform master key committed to a public repository · The Hacker News
  2. Oct 10, 2026Attacker used the key and ran a secret-stealing workflow · GBHackers
  3. Oct 12, 2026Second secret-stealing GitHub Actions workflow ran · GBHackers
  4. Oct 21, 2026Malicious litellm 1.107.0 published; PyPI quarantined it · The Hacker News

What each outlet adds

beyond the shared facts
  • GBHackersOctober 10 and 12 workflows, lookalike pipeline, and deleted release records
  • The Hacker NewsAttacker IP, force-pushed key, named vendor secrets, and Docker tag changes
  • The RecordAbout two hours on PyPI, AWS login tests, and a prior March incident
  • The RegisterCalls the payload an infostealer and remote access trojan targeting browsers
Vendors
BerriAILiteLLM
Products
LiteLLM
Threat actors
TeamPCP
Victims
LiteLLMBerriAI
Organizations
GitHubPyPISocketUpwindWizMicrosoft

Coverage

oldest first · one row per article · UTC
  1. · 6d ago GBHackersFirst report

    LiteLLM GitHub secrets taken 11 days before malicious package release

    October 10 and 12 workflows posted CI secrets to webhook.site; a key committed May 27 was never revoked.

  2. · 6d ago The Hacker News

    Leaked LiteLLM master key used to steal GitHub tokens and publish malicious 1.107.0

    An unrevoked Agent Platform key from May let an attacker publish LiteLLM 1.107.0 to PyPI on October 21; PyPI later quarantined it.

  3. · 4d ago The Record

    Unrevoked LiteLLM key used to publish credential-stealing PyPI package

    Microsoft said the malware ran on every Python startup, and stolen AWS keys were checked against Amazon AI models.

  4. · 4d ago The Register · Security

    LiteLLM supply chain attack began with an unrevoked GitHub master key

    Poisoned release 1.107.0 carried an infostealer and remote access trojan and drew about 49,000 downloads before PyPI quarantined it.