Pull to refresh
Logo
What Changed
Following Why Sign Up
Compromised LiteLLM release on PyPI and Docker installs credential stealer and backdoor

Compromised LiteLLM release on PyPI and Docker installs credential stealer and backdoor

Force in Play

A GitHub master key left unrevoked for 136 days let attackers hijack LiteLLM's release pipeline and push credential-stealing malware to PyPI and Docker Hub

October 23rd, 2026: LiteLLM publishes attack-chain post-mortem

Overview

Updated Oct 30

LiteLLM published a malicious version 1.107.0 on October 21 and pulled it about two hours later. It carried a credential stealer that ran whenever Python started, even in programs that never imported the library, plus a backdoor that checked a GitHub repository for instructions.

LiteLLM's October 23 post-mortem traced the break-in to a GitHub master key exposed on May 27 and never revoked. The attacker used it on October 10 to take an organisation-owner token, then used three engineers' credentials to point the release pipeline at a lookalike repository, Berri-AI/litellm.

Why it matters

Anyone who installed LiteLLM 1.107.0 between 11:39 and 13:23 UTC on October 21 should assume cloud, SSH and AI-tool credentials were stolen.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

23M
Weekly downloads of litellm
Scale of the tool's user base at the time of the compromise.
1h 44m
Time the poisoned PyPI release was live
Published at 11:39 UTC, quarantined by 13:23 UTC.
49,000
Downloads of the poisoned release
Counted by Wiz from ClickPy data for litellm 1.107.0.
7
Malicious wheels published to PyPI
All seven platform wheels of 1.107.0 contained the malware.
3
Developer GitHub credentials compromised
Each was used at a different stage of the release attack.
4.5 hours
Delay until stolen credentials were used
Wiz saw the attacker validating stolen AWS credentials within hours.
136 days
How long the exposed GitHub key stayed active
Exposed on May 27, 2026 and never revoked before the October 21 attack.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

UA
Unknown attacker
Unauthorized actor
Unidentified

Organizations Involved

LiteLLM (BerriAI)
LiteLLM (BerriAI)
Software company
Published its attack-chain account on October 23; advising users to pin to 1.106.2 and rotate credentials

The company behind LiteLLM, an open-source Python proxy for routing AI model requests.
Wiz
Wiz
Cloud security firm
Traced the stolen AWS credentials to Bedrock probing and counted about 49,000 downloads of the poisoned release

Cloud security company that observed the attacker using stolen AWS credentials after the LiteLLM compromise.
JFrog
JFrog
Software supply chain security firm
Analyzed the malicious package

Supply chain security company that detailed the malware's credential theft and remote execution capabilities.
Anthropic
Anthropic
AI company
Claude Code's token behavior was a link in the attack chain

Maker of Claude and Claude Code, whose embedding of GitHub OAuth tokens in logged responses exposed them to the attacker.

Timeline

March 2026 October 2026

15 events Latest: October 23rd, 2026 · 3 weeks ago Showing 8 of 15
Tap a bar to jump to that date

  1. LiteLLM publishes attack-chain post-mortem

    Latest Response

    LiteLLM published a detailed account tracing the release takeover to the unrevoked master key and identifying the three credentials used at different stages.

  2. Branch protection overridden

    Attack

    Privileged developer credential overrides GitHub branch protection to alter release workflow.

  3. Staging run from lookalike repo

    Attack

    Compromised workflow runs staging from attacker-controlled repository Berri-AI/litellm.

  4. Production release begins

    Attack

    Production release pipeline starts after staging completes.

  5. Release gate approved

    Attack

    Second developer credential approves the production release gate.

  6. Malicious wheels hit PyPI

    Exploit

    Seven malicious litellm 1.107.0 wheels uploaded to PyPI.

  7. Compromised Docker images published

    Exploit

    Malicious Docker images published under four tag names on Docker Hub and GHCR.

  8. Workflow records deleted

    Attack

    Third developer credential used to delete workflow records, limiting investigation.

  9. Workflow restored

    Response

    Unauthorized workflow revision removed, pipeline restored to prior state.

  10. PyPI pulls malicious package

    Response

    PyPI removes litellm 1.107.0.

  11. Docker Hub cleaned

    Response

    Docker Hub tags removed or repointed to verified clean images.

  12. Stolen credentials used

    Impact

    Between 16:20 and 17:01 UTC, two IP addresses used AWS instance-role credentials taken from compromised CI runners and Kubernetes nodes to call sts:GetCallerIdentity and list Bedrock models, Wiz reported. In a few environments the attacker also listed IAM roles, users and access keys.

  13. Attacker extracts organisation-owner token

    Attack

    Using the unrevoked key from IP 69.48.229[.]143, the attacker reached LiteLLM's Agent Platform and extracted a GitHub CLI OAuth token tied to the organisation owner's account.

  14. GitHub master key exposed

    Security

    A GitHub master key was exposed and never revoked, remaining active for 136 days, according to LiteLLM's post-mortem as reported by Gate News.

  15. Prior incident prompts CI hardening

    Security

    LiteLLM hardens CI pipeline after prior security incident.

Scenarios

1

LiteLLM publishes final post-mortem, attacker remains unidentified

Likely Resolves by Nov 21, 2026

Discussed by: LiteLLM incident reports, security press

LiteLLM published a detailed attack-chain report on October 23 that traced initial access to a GitHub master key exposed on May 27 and never revoked. The attacker is still unidentified, and the company has not said who was behind the intrusion.

2

Downstream breach traced to stolen LiteLLM credentials

Possible Resolves by End of 2026

Discussed by: Wiz, The Hacker News

Wiz observed the attacker validating AWS instance role credentials from compromised CI runners and Kubernetes nodes within hours of the theft. If those credentials reached downstream organizations, affected companies may disclose breaches as they investigate.

3

PyPI and GitHub mandate release pipeline hardening

Uncertain Resolves by Apr 30, 2027

Discussed by: Security researchers analyzing the incident

The attack exploited mutable GitHub Actions workflow protections and unsigned artifacts. Security researchers are likely to press PyPI and GitHub to require build provenance and immutable release tags as a direct response.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

December 2020

SolarWinds supply chain attack (2020)

In December 2020, FireEye discovered that attackers had slipped a backdoor called SUNBURST into SolarWinds' Orion IT monitoring platform. Pushed through legitimate software updates, the malware reached roughly 18,000 customer organizations, including US federal agencies.

Then

The intrusion went undetected for months; FireEye disclosed it in December 2020, triggering a US government review.

Now

It drove a wave of supply chain security measures, including new federal requirements for software provenance.

Why this matters now

Shows how compromising one build pipeline distributes malware across a broad downstream user base.

April 2021

Codecov Bash Uploader compromise (2021)

In April 2021, an attacker modified Codecov's Bash Uploader script, which thousands of projects use to report code coverage from CI systems. The altered script exfiltrated credentials and tokens from customers' continuous integration environments for about two months.

Then

Codecov advised customers to rotate all credentials that flowed through affected CI environments.

Now

It became a standard case study in upstream tool compromise stealing CI credentials.

Why this matters now

Directly parallels LiteLLM: a popular developer tool compromised to harvest credentials from build and deployment environments.

March 2024

XZ Utils backdoor (2024)

In March 2024, engineer Andres Freund found a backdoor in XZ Utils, a widely used Linux compression library. The backdoor, planted over two years through a slow campaign against the project's maintainer, could have allowed remote code execution on OpenSSH connections.

Then

The backdoor was removed before mainstream Linux distributions shipped it.

Now

It showed how attackers can win trust in open-source projects through sustained social engineering.

Why this matters now

LiteLLM differs, a fast pipeline takeover rather than a slow trust build, but both target widely deployed open-source infrastructure.

Sources

(21)
+15
LiteLLM OSV Datadog Security Labs Hol AISLE ThreatCluster Hacker News Cyber Daily The Hacker News SafeDep BleepingComputer The Next Web OX Security Brocker Microsoft Security Blog Gate News HivePro Codekeeper Softtechhub LiteLLM The Hacker News