Leaked LiteLLM Master Key Enables Attackers to Hijack GitHub Tokens and Supply‑Chain Release Pipeline

Summary

LiteLLM disclosed that a master key for its Agent Platform was unintentionally committed to a public GitHub repository on May 27 2026. The key was never revoked, allowing an unknown attacker to exploit it on October 10 2026. The attacker harvested an unrestricted GitHub CLI OAuth token, used it to push a malicious version of the LiteLLM Python package, and exfiltrated dozens of additional secrets before the breach was reported on October 21 2026.

Confirmed Facts

• May 27 2026 – A configuration file in the public `LiteLLM-Labs/lite-harness` repo contained the Agent Platform master key. The commit was force‑pushed and the key was marked for revocation, but revocation never occurred.
• October 10 2026 – The attacker, operating from IP `69.48.229[.]143`, used the unrevoked master key to obtain a GitHub CLI OAuth token that had owner‑level scope for the organization.
• October 10‑12 2026 – Short‑lived branches (`ci‑tmp‑…`) were created, each adding a workflow (`.github/workflows/cache.yml`) that harvested tokens, API keys, and other credentials, then sent them to two attacker‑controlled webhook endpoints.
• October 21 2026 – The malicious workflow altered the release pipeline, causing LiteLLM version 1.107.0 to be published to PyPI and Docker Hub with embedded malware. The packages were quickly quarantined by PyPI and Docker Hub removed the tags.
• Post‑incident – LiteLLM is revoking all tokens, tightening release‑approval controls, and investigating additional exfiltrated secrets.

Reported Claims & Open Questions

• LiteLLM claims the release‑approval restriction was temporarily relaxed to allow any two engineers to trigger and approve a release. It is unclear whether the attacker leveraged this policy change or used the organization‑owner token to bypass it entirely.
• The company suspects the attacker could have further weakened or removed the restriction but sees no evidence of such activity.
• The full list of stolen credentials (e.g., Anthropic, OpenAI, AWS Bedrock, etc.) is still being catalogued; the extent of downstream compromise remains unknown.

Practical Implications

• Developers should audit any Python environment that may have installed LiteLLM 1.107.0, even if the package was never imported, because the malicious code executes on interpreter start.
• Organizations must rotate all GitHub OAuth tokens, GitHub App keys, and any cloud‑provider credentials that were potentially exposed.
• Supply‑chain defenders should monitor PyPI and Docker Hub for unexpected version bumps and verify package signatures before deployment.

How to Verify the Original Announcement

1. Check LiteLLM’s official blog or security advisory page for a post dated October 21 2026.
2. Review the GitHub commit history of `LiteLLM-Labs/lite-harness` for the May 27 commit and its subsequent force‑push.
3. Search PyPI for version 1.107.0 and confirm its quarantine status.
4. Look for security notices from Docker Hub, GitHub Security, and third‑party researchers (Socket, Microsoft Security Research) that reference the same timestamps and IP address.

---

Keywords

• LiteLLM master key leak
• GitHub OAuth token theft
• Supply‑chain attack Python package
• PyPI malicious version 1.107.0
• Credential harvesting workflow
• Token revocation failure
• Secure release pipeline
• Cloud‑agent security
• Open‑source LLM gateway breach
• Webhook exfiltration