Stolen GitHub Tokens Put Malware in a LiteLLM Release
LiteLLM says three engineers' GitHub CLI OAuth tokens were used to push version 1.107.0 to PyPI and the Docker registry on 21 October 2026. The build carried a credential stealer and a remote access tool. The last clean public release is 1.106.2.
LiteLLM's release pipeline was compromised at 04:00 Pacific on 21 October 2026 and pushed version 1.107.0 of the package to both PyPI and the Docker registry, according to the incident report the project published the same day. The build carried compiled malware that steals credentials and loads remote code execution tooling. Every earlier version is clean, and the poisoned artifacts have been removed from PyPI, Docker Hub and GHCR.
LiteLLM is an open source proxy that routes API calls across language model providers, which is what makes it worth the effort of attacking. A machine running it usually holds keys for several model vendors and at least one cloud account in the same process.
Three engineers' tokens, one approval
The project says the malicious actions were taken through three engineers' GitHub accounts, apparently by way of stolen GitHub CLI OAuth tokens. One account was used to change the release pipeline and trigger the project-releaser run. A second was used to approve it. The attackers disabled branch protections and pointed the releaser at a lookalike repository, Berri-AI/litellm, standing in for the real BerriAI/litellm, then signed and published from there. The official v1.107.0 source tag on GitHub contains none of the malicious files.
LiteLLM's advisory, last updated at 16:00 UTC on 21 October, says it had not identified how the threat actor acquired the tokens and therefore could not assert that there was no further access to those accounts. SecurityWeek reported that the project's investigation pointed to the tokens being written into LiteLLM's own logs by Claude Code, which in specific circumstances would embed them in a response body. That is a working explanation rather than a confirmed one.
What the build took
The payload dropped three files into the site-packages root so that they execute whenever a Python interpreter starts, which is why the project's clean-up instructions open by telling people not to begin with pip. SecurityWeek's account of the stealer lists system information, browser credentials and cookies, developer credentials, environment variables, cloud secrets for AWS, GCP and Azure, API keys for AI tools including Anthropic, OpenAI and GitHub Copilot, SSH private keys, shell history files and GPG keys. The encrypted haul went to a domain spelled litellm.dev.
checks a GitHub dead drop every hour and runs whatever Python the attacker serves
Wiz said the attackers began abusing the stolen credentials roughly four and a half hours after exfiltration, and observed them querying Amazon Bedrock models with stolen AWS credentials, the resource theft pattern the industry calls LLMjacking.
A short window, a long tail
The exposure was narrow in time. LiteLLM puts the pip window at 11:39 to 13:23 UTC on 21 October and the Docker window, covering the v1.107.0, latest, main-latest and main-stable tags, at 11:46 to 14:20 UTC the same day. An estimate drawn from PyPI's published download statistics and cited by SecurityWeek puts downloads of the affected version above 49,000, which counts pulls rather than infected machines.
The honest reading is that the window is the least interesting number here. A stealer that runs on build agents and developer laptops turns under three hours of exposure into an open-ended problem, because what it took was the keys to everything those machines could reach. Mirai operators spent days throwing PHP2Shell exploits at the internet with no confirmed compromise, as Parallax Nexus reported on 24 October. This one was signed, published through official channels, and spending stolen AWS credit before lunch.
LiteLLM has revoked the tokens involved, removed all but one user from its GitHub organisation, and cut the trusted publishing links between its public registries and that organisation. Enterprise customers pulling from the private registry were not affected. That registry was carrying an embargoed release fixing a separate vulnerability due for disclosure on 27 October.
Anyone who installed during the window is being told to treat the host as compromised rather than simply to upgrade: remove the dropped files, rotate every credential the machine could reach, revoking at the provider first, and rebuild affected GCP servers. The project credits a researcher posting as LidorMachluf with helping it detect the incident.
What happens next?
- LiteLLM's investigation into how the GitHub CLI OAuth tokens were obtained remains open, and the project has not ruled out continued access to the affected accounts.
- A separate LiteLLM vulnerability, carried in an embargoed enterprise release during the incident, was scheduled for public disclosure on 27 October 2026.
- Credentials exposed during the window stay usable until they are rotated, and the Bedrock queries Wiz observed suggest cloud billing is where many victims will notice first.
Related topics
Sources & references
- 01Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised — LiteLLMprimaryProject incident report, last updated 16:00 UTC on 21 October 2026. Source of the timeline, the affected tags and the account of the three compromised GitHub accounts.
- 02LiteLLM Compromised in Fresh Supply Chain Attack — SecurityWeeknewsAccessed 26 October 2026. Source of the payload inventory and the download estimate drawn from PyPI statistics.
- 03LiteLLM compromised, steals credentials — WizresearchVendor research cited for the four and a half hour gap between exfiltration and credential abuse, and the Amazon Bedrock queries.
- 04LiteLLM 1.107.0 compromised: PyPI backdoored wheels, credential stealer — StepSecurityresearchSource of the quoted description of the remote access component.
More from Security
Attackers Are Escalating to Root Through a Japanese Web Firewall
A command injection flaw in the SiteGuard Server Edition web application firewall, CVE-2026-106931, is being exploited to run commands as root or SYSTEM. JPCERT/CC alerted users on 14 October 2026 and the vendor told support customers on 29 September.
Attackers Chained Three Ivanti Zero-Days and One Is Still Unfixed
Ivanti disclosed CVE-2026-104935 on 13 October 2026 and CISA added it to the Known Exploited Vulnerabilities catalogue the same day. Volexity found an attacker running commands as root on a fully patched VPN gateway from 3 October.
China-Linked Scanner Holds 1,300 Exploit Scripts, FBI Says
A joint advisory led by the FBI describes MicroScan, a Python web application holding more than 1,300 penetration-testing scripts that China-linked actors have used since at least 2017. CISA added five of the eight named flaws to its exploited-vulnerability catalogue with a federal deadline that expired on 11 October.
FBI Removes Contractor Over an Unapplied PeopleSoft Patch
The FBI says the breach of its job applicant portal followed a third party's failure to install a security patch, and has removed the contractor responsible. Reuters, citing two unnamed sources, identified the contractor as working for Accenture and the platform as Oracle PeopleSoft.