LiteLLM Release Pipeline Hijacked Through an Unrevoked Master Key
Anyone who installed LiteLLM 1.107.0 from PyPI, Docker Hub or GHCR in the affected window may need to treat their credentials as exposed.
LiteLLM disclosed that a master key for its Agent Platform, accidentally committed to a public GitHub repository on May 27, 2026, was never revoked, and an attacker used it on October 10, 2026 to obtain a GitHub CLI OAuth token tied to an organization owner account. That token gave the intruder owner-level reach across the organization's repositories, which was used to alter the release pipeline to point at a lookalike repository and push a malicious LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR on October 21. PyPI quarantined the release and Docker tags were reverted to verified clean images. The company is now rotating every token tied to its internal systems and vendor platforms, and it has relaxed a two-person release approval rule that the attacker exploited.
Why it matters
The incident shows how a single credential left unrevoked after a public leak can reach an entire software supply chain, turning a trusted open-source package into a delivery vehicle for malware. For developers who depend on LiteLLM, the malicious version was quarantined and Docker tags were reverted, but the attacker had also aimed to collect GitHub tokens and keys for Anthropic, OpenAI and AWS Bedrock, so the practical consequence is that exposed credentials, not just the package itself, are the risk to watch.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.