LiteLLM Traces Malicious Release to Master Key Left Unrevoked

LiteLLM traced its malicious v1.107.0 release to an Agent Platform master key committed to a public repository in May and left active, linking the Oct. 21 compromise to a credential exposure that began months earlier.

LiteLLM’s open-source gateway lets applications connect to more than 100 large language model providers through a single interface. The new root-cause timeline adds to earlier coverage of the release’s credential risks and remediation, detailing how the incident reached the release pipeline.

A configuration file containing the master key was committed to the public LiteLLM-Labs/lite-harness repository May 27. The key had been flagged for revocation but remained active.

On Oct. 10 at 5:27:10 p.m. ET (21:27:10 UTC), an API response returned a GitHub CLI OAuth token associated with an organization owner. LiteLLM’s investigation traces the attacker’s subsequent use of CI workflows to obtain tokens for two maintainers.

On Oct. 21, the owner’s token was used to override branch protections and redirect the release workflow from BerriAI/litellm to the lookalike Berri-AI/litellm repository. A maintainer’s token approved the production release. Release controls had been relaxed to let two engineers trigger and approve more frequent bug-fix releases.

Seven malicious PyPI wheels were published between 7:39:51 and 7:40:13 a.m. ET (11:39:51–11:40:13 UTC). The package was removed by 9:23 a.m. ET (13:23 UTC). Docker Hub and GitHub Container Registry images were published at 7:46:56 a.m. ET (11:46:56 UTC). Affected GitHub Container Registry tags were unavailable by 9:51 a.m. ET (13:51 UTC), while Docker Hub tags were removed or pointed to clean images by 10:20 a.m. ET (14:20 UTC).

LiteLLM identified litellm==1.107.0 and Docker tags v1.107.0, latest, main-latest and main-stable as affected. The payload stole credentials and loaded tools for remote code execution. LiteLLM’s private enterprise release was not affected. The company planned to share process improvements during the week of Oct. 26.