Unrevoked master key enabled LiteLLM supply chain attack

LiteLLM traced its supply chain compromise to a master key accidentally committed to a public GitHub repository on May 27. Developers removed the exposed commit but did not revoke the key, leaving attackers a path into an internal platform used to orchestrate AI agents.

On October 10th, the attacker used the key to access the LiteLLM Agent Platform and extract a GitHub CLI OAuth token granting owner-level access across its GitHub repositories. The token bypassed additional authentication checks normally required for sensitive repository actions. Malicious workflows then stole further credentials, including tokens belonging to engineers with maintainer privileges, allowing changes and approvals to appear legitimate.

The attacker distributed compromised version 1.107.0 through PyPI and container registries. It contained an infostealer and a remote access trojan capable of executing arbitrary code. According to Wiz, the package received about 49,000 downloads while available on PyPI for less than two hours before quarantine. Targeted data included browser credentials and cookies, cloud credentials, and API keys for OpenAI, Anthropic, Cohere, and other model providers.

LiteLLM is revoking every token associated with its internal systems and vendor platforms. Anyone who installed and ran the compromised release should assume accessible credentials may have been stolen, investigate affected systems, change passwords, and rotate exposed keys.