LiteLLM details attack chain behind compromised v1.107.0 PyPI release

LiteLLM published a post-incident account of how a compromised litellm==1.107.0 was released to PyPI and container registries on October 21. The attack chain began with a master key committed to a public repository on May 27, which was not revoked. The attacker then obtained a GitHub organization owner's CLI OAuth token on October 10, used it to exfiltrate further maintainer tokens via CI workflows, bypassed branch protection, and triggered and approved a production release. The post states it is the canonical source of truth and that the timeline was reconstructed from investigation.

Key takeaways

• A master key committed to a public repository on May 27 was not revoked, enabling later access.
• An organization owner's GitHub CLI OAuth token was exposed via the Agent Platform API on October 10.
• The attacker used maintainer tokens to approve the production gate, which was relaxed to allow any two engineers.
• Malicious wheels were published to PyPI at 11:39 to 11:40 UTC on October 21, with Docker images following.

Why it matters

The incident shows how an unrotated secret and overly broad, unscoped tokens can chain into a compromised package release reaching downstream users. It highlights the need for token rotation, scoped service accounts, and robust release approval controls in AI infrastructure supply chains.

Read with care

Source claims not independently checked; the post itself notes earlier updates were partly inaccurate and may be revised.