Leaked LiteLLM Key Enabled GitHub Token Theft and Malicious Package Release
Summary
LiteLLM says an unrevoked Agent Platform key enabled an attacker to obtain an organization-level GitHub token and publish malicious LiteLLM 1.107.0. Socket and Microsoft describe secret-stealing workflows and Python-startup malware; LiteLLM is revoking credentials.
Key points
- LiteLLM said a configuration file committed publicly on May 27, 2026, exposed an Agent Platform master key that was not revoked.
- LiteLLM says an attacker used the key on October 10 to access the platform and extract an unscoped GitHub CLI OAuth token associated with its organization owner.
- The attacker reportedly used tokens to trigger and approve a release after redirecting the deployer to a malicious repository, resulting in malicious LiteLLM version 1.107.0.
- Socket identified two malicious workflows on short-lived branches. They were designed to collect GitHub and service credentials, API keys, browser session data, and database credentials, then send data to webhook[.]site endpoints.
- The malicious package reportedly runs code when Python starts, even if LiteLLM is not imported; its components include credential theft and a Unix backdoor that fetches and executes code hourly.
- LiteLLM said it is revoking tokens across internal systems and vendor platforms. Microsoft warned that startup components outside the application directory may remain after removing only the application files.
Article Details
- Victim Organization
- LiteLLM
- Incident Type
- Software supply-chain compromise involving a malicious LiteLLM package release, credential theft, and release-pipeline hijacking
- Incident Date
- 2026-10-10
- Data Types Exposed
- GitHub CLI OAuth token
- GitHub tokens
- GitHub App private key and identifier
- API keys and other tokens
- Playwright browser storage state
- PostgreSQL connection string, account name, and password
- Redis endpoint address, port, and authentication password
- SSH files
- Git and GitLab credentials and tokens
- Environment variables
- Package-manager tokens
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- The attacker used an unrevoked Agent Platform master key to access a GitHub CLI OAuth token, then used organization-owner access to trigger and approve a release after repointing the deployer to a malicious repository. Malicious workflows harvested credentials and secrets. Files in LiteLLM version 1.107.0 could execute when Python started, including when LiteLLM was not imported; a Unix-oriented backdoor could fetch and execute attacker-supplied code hourly. LiteLLM said it was working to revoke tokens associated with its internal systems and vendor platforms.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 69[.]48[.]229[.]143 | IP address from which LiteLLM said the unknown attacker operated while using the unrevoked master key. |
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainThe attacker repointed the deployer to a malicious repository and used it to trigger a malicious LiteLLM package release, consistent with a software supply-chain compromise.T1528 · Steal Application Access TokenThe attacker extracted and used a GitHub CLI OAuth token to gain access to the organization's repositories.T1552.001 · Credentials In FilesA configuration file committed to a public repository contained the Agent Platform master key later used by the attacker.T1555.003 · Credentials from Web BrowsersThe malicious package's credential-harvesting module targeted authentication material in web browsers.T1567.004 · Exfiltration Over WebhookThe article says credentials and other collected data were exfiltrated to webhook.site endpoints.
People
Karlo ZankiSocket security researcher who reported on the malicious workflow commits and credential-harvesting activity.Mateo WangA LiteLLM representative who described the exposed master key and incident.Oliver JensenA LiteLLM representative who described the exposed master key and incident investigation.
Vendors
Amazon Web ServicesThe October 12 run extends the collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQLAnthropicThe October 12 run extends the collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQLGitGuardianthe collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQL database informationGitHubLiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular PythonLinearas highlighted by LiteLLM, are equipped to harvest GitHub tokens and API keys for the organization's Linear workspace, LiteLLM deployment, and Together AI, along with the identifier and signing key of a GitHub App.LiteLLMLiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular PythonOpenAIThe October 12 run extends the collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQLTavily12 run extends the collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQL databaseTogether AIto harvest GitHub tokens and API keys for the organization's Linear workspace, LiteLLM deployment, and Together AI, along with the identifier and signing key of a GitHub App.
Products
GitHub AppLinear workspace, LiteLLM deployment, and Together AI, along with the identifier and signing key of a GitHub App.GitHub CLIused this unrevoked key on October 10, 2026, to gain access to the Agent Platform and extracted a GitHub CLI OAuth token the service was configured with to allow self-hosted cloud agents to file pull requests toGitLabThe stealer also collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo. TheLiteLLMLiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular PythonLiteLLM Agent Platformrepository which inadvertently contained the master key to a deployment of the LiteLLM Agent Platform, an open source tool we use for orchestrating agents," LiteLLM's Oliver Jensen and Mateo WangPlaywrightfor Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQL database information (connection string, account name, password), RedisPostgreSQLBedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQL database information (connection string, account name, password), Redis endpoint address, port, andPythonin late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.RedisPlaywright storage state, PostgreSQL database information (connection string, account name, password), Redis endpoint address, port, and authentication password.