LiteLLM: poisoned 1.107.0 release published through its own pipeline

How it happened

LiteLLM says an administrative key to an internal Agent Platform was committed to a public repository on May 27 and never revoked. On October 10 the attacker used it to get an organization owner's GitHub token, then ran short-lived workflows that sent CI secrets, including two other maintainers' tokens, to an outside server. On October 21 the owner's token overrode branch protection, a second maintainer's token approved the production release, and the release was built from a lookalike repository. How the attacker found the key is not public.[1][2][4] Checked 8 Nov 2026

What was stolen

From LiteLLM: the Agent Platform key, three maintainers' GitHub tokens, CI secrets and all secrets of private repositories targeted on October 12, and tokens for other internal systems and vendor platforms. The malicious package itself collects credentials from the machines where it runs: cloud, SSH, Git, Kubernetes, CI and environment secrets, and on proxy hosts provider keys. Microsoft did not confirm that a second stage was ever retrieved. The number of hosts that lost data is not public.[1][2][3] Checked 8 Nov 2026

Who was impacted

Anyone who installed or ran litellm 1.107.0 or the affected Docker tags while they were live. PyPI: 11:39 to 13:23 UTC. Docker Hub: 11:46 to 14:20 UTC. GHCR: until about 13:51 UTC. LiteLLM says enterprise customers pulling from its private registry were not affected. Download or victim counts are not public.[2] Checked 8 Nov 2026

Threat actor

Not attributed. No attribution. LiteLLM, Microsoft and The Hacker News name no threat actor.

Timeline

1. 27 May 2026An administrative key to LiteLLM's internal Agent Platform is committed to a public repository. The file is removed about three hours later, but the key is not revoked. [1]
2. 10 Oct 2026The attacker uses the key to obtain an organization owner's GitHub token, then exfiltrates CI secrets, including two other maintainers' tokens. [1]
3. 21 Oct 2026Malicious litellm 1.107.0 goes live on PyPI at 11:39 UTC and on Docker Hub and GHCR at 11:46 UTC. A security researcher flags it in a GitHub issue about 20 minutes later. PyPI quarantines it by 13:23 UTC. [1][2]
4. 23 Oct 2026Microsoft publishes its analysis of the payload. LiteLLM publishes its root cause analysis and says every token is treated as exposed. [1][3]
5. 30 Oct 2026LiteLLM adds that it rotated its cosign image-signing key on October 23. The compromised images carry a valid signature from the previous key. [2]