LiteLLM has published its account of how the backdoored 1.107.0 release reached PyPI and Docker on October 21, which we covered on the day when the company had not yet found how the attacker got its engineers’ tokens. According to LiteLLM’s security team, a configuration file committed to the public LiteLLM-Labs/lite-harness repository on May 27, 2026 contained the master key for a deployment of its experimental Agent Platform. The commit was overwritten and the keys were marked for revocation, but “key revocation did not occur for the master key.”
On October 10 the attacker used that key to reach the Agent Platform and took a GitHub CLI OAuth token the service held so it could open pull requests. LiteLLM says the token belonged to its GitHub organization owner’s account and was not scoped down, giving owner-level access to every repository. With it, the attacker pushed short-lived branches that ran workflows to collect CI secrets, which yielded tokens for two engineers with maintainer rights. On October 21 the attacker repointed the release pipeline at a lookalike repository, used the org owner’s token to disable a branch restriction, then used one engineer token to trigger the release and the other to approve it. LiteLLM says it had relaxed its two-person release rule earlier that week, and that it believes the attacker used separate tokens to avoid noisy audit logs. This replaces the company’s earlier working theory that the tokens were stolen from internal deployment logs, which it now says was inaccurate.
Socket, which analysed the malicious workflows, told The Hacker News the attacker’s two workflow commits (October 10 and October 12) went to throwaway branches that were deleted within minutes. It reports the workflows were built to collect GitHub tokens and a GitHub App signing key, plus API keys for services including Anthropic, OpenAI, AWS Bedrock and GitGuardian, and database and Redis credentials. LiteLLM says it is revoking every token tied to every internal system and vendor platform.
How to check if you’re affected
Affected versions are LiteLLM 1.107.0 only, from PyPI or from the Docker tags LiteLLM named. The earlier post lists the exact images, file indicators and the recovery steps to follow.
- Run
pip show litellmor check your lockfile and image digests for 1.107.0, and treat any host that ran it as compromised. - Rotate every credential that host could reach, as in the earlier post.
- For your own projects, the lesson from this report is concrete: when a key is committed to a public repository, rotate it rather than just removing the commit, and avoid giving automation a personal owner-level OAuth token.
Sources
- LiteLLM: The attack chain behind the v1.107.0 LiteLLM release
- Socket: LiteLLM attack timeline (linked from The Hacker News; the page blocks automated fetching)
- The Hacker News: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline