Leaked LiteLLM master key let attackers hijack its release pipeline

LiteLLM disclosed that a master key for its Agent Platform, accidentally committed to a public GitHub repository in late May 2026, was never revoked even after the exposure was caught and the commit was force-pushed over. An unknown attacker used that still-valid key on October 10, 2026, to access the Agent Platform and steal a GitHub CLI OAuth token with unrestricted, organization-owner-level access.

Using that access, the attacker ran hidden workflows in short-lived, quickly deleted branches to harvest more tokens, then on October 21 overrode branch protection and redirected the release pipeline to a lookalike repository, "Berri-AI/litellm" instead of the real "BerriAI/litellm." This let them publish a malicious LiteLLM version 1.107.0 to PyPI, followed minutes later by Docker Hub and GHCR images. An Upwind researcher reported the attack less than half an hour after the PyPI release, and the malicious version was later quarantined and removed.

The malicious package ran automatically when Python started, even without LiteLLM being imported, combining a credential-harvesting module targeting developer tools, cloud environments and browsers with a backdoor that fetched and ran attacker code every hour. Security firm Socket found the attacker's hidden workflows also targeted secrets for Linear, Together AI, Anthropic, OpenAI, AWS Bedrock, and GitGuardian. LiteLLM is now working to revoke all tokens tied to its internal systems and vendor platforms.

Why it matters

It's a reminder that a single unrevoked leaked credential can sit dormant for months before enabling a full software supply-chain takeover.

Source: The Hacker News