On October 21, 2026 a compromised LiteLLM release appeared on PyPI and container registries (Litellm). Threat actors had seized the release pipeline and pushed malicious code to PyPI, Docker Hub, and GitHub Container Registry (The Hacker News).
The breach traces back to May 27, 2026, when a configuration file containing a master key was accidentally committed to a public repo. Although the commit was later force‑pushed, the key was never revoked.
That unrevoked key opened the experimental LiteLLM Agent Platform, which stored a GitHub CLI OAuth token. Because the token belonged to the organization owner and lacked scope restrictions, the attacker gained owner‑level rights across all repositories.
On October 10, 2026 the attacker created disposable internal branches and, using automated workflows, siphoned OAuth tokens from two maintainer engineers via an external webhook.
Eleven days later the attacker bypassed branch‑protection rules, rewired the release pipeline, and pointed the build source to a lookalike repo named Berri‑AI/litellm instead of the legitimate project.
The threat actor then exploited a temporary rule that let any two engineers trigger and approve builds; version 1.107.0 was built and published to PyPI and container platforms before researchers disclosed the attack.
Microsoft analysis shows the compromised package leveraged Python startup hooks to run payload scripts as soon as the interpreter started (Microsoft Security Blog). The payload executed even without an explicit LiteLLM import, harvesting credentials automatically.
Security teams should avoid running Python or pip in suspect environments. Remediation requires stopping active processes, cleaning affected systems, and rotating every credential that could have been exposed.
This incident highlights how minor operational oversights, such as failing to revoke a leaked key or scoping OAuth tokens improperly, can cascade into critical supply chain vulnerabilities. As development teams adopt automated release pipelines and agentic orchestration platforms, enforcing strict least-privilege policies and mandatory hardware authentication remains essential.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation