NEWS

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack the Release Pipeline

LiteLLM's post-mortem: a master key committed publicly in May and never revoked led to stolen GitHub tokens and the malicious 1.107.0 release on PyPI and Docker.

Dylan H.

News Desk

October 24, 2026
3 min read
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack the Release Pipeline

Overview

LiteLLM has disclosed how the malicious 1.107.0 release reached PyPI, Docker Hub and GHCR (see our earlier coverage of the package compromise). The root cause: a master key for its Agent Platform was accidentally committed to a public GitHub repository on May 27, 2026, force-pushed over within minutes, but never revoked.

Timeline (UTC)

  • May 27: A configuration file containing the key is committed to the public LiteLLM-Labs/lite-harness repository. The commit is overwritten, but the key stays valid.
  • October 10: An attacker uses the key to access the Agent Platform and extract a GitHub CLI OAuth token, then runs workflows on throwaway branches in internal repositories to harvest tokens from two maintainer engineers. The runs are deleted minutes later.
  • October 12: A second malicious workflow commit is pushed.
  • October 13: The exfiltration domain litellm[.]dev is registered.
  • October 21: The attacker overrides branch protection, repoints the release pipeline to a lookalike repository (Berri-AI/litellm), and publishes 1.107.0 to PyPI (about 11:39) and Docker Hub/GHCR (about 11:46). Upwind researcher Lidor Machluf reports it at 12:06; PyPI quarantines the release at 13:23 and Docker tags are restored to clean images later that afternoon.

How the Attack Worked

  1. The unrevoked master key gave access to the Agent Platform.
  2. The GitHub CLI OAuth token it held was "not scoped down" and tied to an organization owner's account, giving owner-level access to every repository.
  3. Credential-harvesting workflows were added as .github/workflows/cache.yml on short-lived ci-tmp-<hex> branches with the commit subject "ci: bump cache config".
  4. Releases normally needed an engineer to start them and a special account locked to an office device to approve them. LiteLLM had recently relaxed this so any two engineers could trigger and approve, and the attacker used one stolen token for each step.

What Was Targeted

GitHub tokens (including a GitHub App private key), Linear and Together AI credentials, and, in the October 12 workflow, Anthropic, OpenAI, AWS Bedrock, Tavily and GitGuardian API keys, Playwright storage state, and PostgreSQL and Redis connection details. Data went to webhook.site endpoints. The 1.107.0 payload itself ran at Python startup, stole developer, cloud and package-registry credentials, and installed a backdoor that fetched code hourly. Microsoft noted the startup files live outside the application directory, so deleting only the package may leave them behind.

Recommended Actions

  1. If you installed 1.107.0, rebuild the environment from a clean image and hunt for leftover startup files, not just the package.
  2. Rotate every credential reachable from affected hosts: GitHub, cloud, AI provider, database and registry tokens.
  3. Search GitHub audit logs for ci-tmp- branches and cache.yml workflows, and block litellm[.]dev.
  4. Always revoke a secret the moment it is committed publicly; rewriting history does not invalidate it.
  5. Scope CI and agent tokens down, and keep release approval tied to hardware-bound accounts that no stolen token can satisfy.

Sources