INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

LiteLLM Master Key Leaked Allowing Attackers to Hijack GitHub Releases

| 2026-10-24 11:03 HIGH LOW DATA BREACH CRITICAL INFRASTRUCTURE & OT
JSON
Executive Summary
AI-generated
An unknown attacker gained access to the Agent Platform master key, which was accidentally published to a public GitHub repository in late May 2026. The attacker used this unrevoked key on October 10, 2026, to gain owner-level access to all repositories across an organization and perform additional credential exfiltration. The attacker extracted a GitHub CLI OAuth token associated with the organization's account, which allowed them to possess owner-level access to all repositories. This attack worked by exploiting the relaxed release approval process that occurred earlier in May 2026, allowing any two engineers to trigger and approve releases without authorization. As of October 21, 2026, the affected organization had reported a supply chain attack, with PyPI quarantining LiteLLM version 1.107.0 and Docker Hub removing or repointing tags related to this release.
Technical Mitigations AI-generated
• Patch the LiteLLM Agent Platform to revoke the exposed master key and prevent future unauthorized access. • Monitor GitHub repositories for suspicious activity, such as commits from throwaway branches or unauthorized webhook endpoints. • Implement strict branch protection and release pipeline controls to prevent unauthorized modifications.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
li•••••.dev
69.48.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA technologytechnology
Incident Timeline
‎October 21, 2025
Attackers exploited a vulnerability in the LiteLLM model to obtain its master key, which they then used to steal GitHub tokens and hijack release pipelines.
industry Technology
General Document Context
‎late May 2026
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.
tactic T1059.006 - Python
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.
‎May 2026
The leaked LiteLLM master key in May 2026 was used to hijack a release pipeline, allowing attackers to steal GitHub tokens.
organisation Leaked
Leaked master key in May 2026 "This restriction was relaxed earlier this week to accommodate the temporary push for more frequent releases and bugfix backports, allowing any two engineers to trigger and approve a release.
organisation API
LiteLLM also said the workflows are designed to identify and exfiltrate additional keys and tokens, specifically focusing on upstream inference API tokens.
organisation the Workflows Emerge
More Details About the Workflows Emerge Socket, which published its own investigation into the malicious workflows, said it recovered two malicious commits that each added a workflow at ".github/workflows/cache.yml."
‎May 27, 2026
A configuration file was committed to the public LiteLLM-Labs/lite-harness repository on May 27, 2026, inadvertently containing the master key to a deployment of the LiteLLM Agent Platform.
industry Technology
General Document Context
‎October 10, 2026
An attacker used a leaked LiteLLM master key to gain unauthorized access, steal GitHub tokens and hijack the release pipeline.
industry Technology
General Document Context
observable 69.48.229.143
" LiteLLM said the unknown attacker (operating from "69.48.229[.]143") used this unrevoked key on October 10, 2026, to gain access to the Agent Platform and extracted a GitHub CLI OAuth token the service was configured with to allow self-hosted cloud agents to file pull requests to GitHub repositories.
organisation CLI
" LiteLLM said the unknown attacker (operating from "69.48.229[.]143") used this unrevoked key on October 10, 2026, to gain access to the Agent Platform and extracted a GitHub CLI OAuth token the service was configured with to allow self-hosted cloud agents to file pull requests to GitHub repositories.
organisation UTC
The sequence of actions performed by the threat actor following this step is as follows - October 10, 2026, between 10:11 and 10:12 p.m. UTC:
infrastructure 1.107.0
What the Malicious Version of the Package Does Multiple reports have revealed that the files bundled with LiteLLM version 1.107.0 are engineered to execute automatically when Python starts, even if an application did not import LiteLLM.
organisation GitHub
The token, per the developers of the open-source large language model (LLM) gateway, was "not scoped down" and associated with its GitHub organization owner's account.
organisation CLI Oauth
Author commits into throwaway branches on internal repositories to run workflows (BerriAI/litellm and BerriAI/litellm-auto) designed to acquire GitHub CLI Oauth tokens associated with two engineers with maintainer privileges via an attacker-controlled webhook[.]site endpoint.
organisation The Hacker News
"Neither commit was pushed to a branch that still exists," Socket security researcher Karlo Zanki said in a report shared with The Hacker News.
organisation Linear
Both workflows, as highlighted by LiteLLM, are equipped to harvest GitHub tokens and API keys for the organization's Linear workspace, LiteLLM deployment, and Together AI, along with the identifier and signing key of a GitHub App.
organisation SSH
Compromised LiteLLM 1.107.0 execution flow The stealer also collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo.
organisation GitLab
Compromised LiteLLM 1.107.0 execution flow The stealer also collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo.
organisation npm
Compromised LiteLLM 1.107.0 execution flow The stealer also collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo.
organisation RubyGems
Compromised LiteLLM 1.107.0 execution flow The stealer also collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo.
organisation Cargo
Compromised LiteLLM 1.107.0 execution flow The stealer also collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo.
‎October 12
Attackers exploited the extended collection of secrets on GitHub to steal tokens and hijack release pipelines.
organisation AWS Bedrock
The October 12 run extends the collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant.
organisation GitGuardian
The October 12 run extends the collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant.
‎October 13, 2026
Attackers exploited a vulnerability in LiteLLM deployments to activate malicious code, potentially exposing GitHub tokens and hijacking release pipelines.
industry Technology
General Document Context
organisation Microsoft Security Research
"Together, these mechanisms extended potential exposure beyond active LiteLLM deployments: simply starting Python in an affected environment could activate the malicious code, even when LiteLLM itself was never imported," the Microsoft Security Research team said .
‎October 21, 2026
Attackers exploited the leaked LiteLLM master key to hijack a GitHub token, which was then used to target and hijack a release pipeline.
industry Technology
General Document Context
infrastructure 1.107.0
UTC: LiteLLM version 1.107.0 gets published to PyPI on October 21, 2026, 11:46 a.m.
UTC: PyPI quarantines LiteLLM version 1.107.0.
organisation Upwind
UTC: Supply chain attack reported by Upwind researcher Lidor Machluf. October 21, 2026, 1:23 p.m.
organisation PyPI
UTC: PyPI quarantines LiteLLM version 1.107.0.
‎2026/10/24
Attackers exploited the leaked LiteLLM master key to gain unauthorized access, steal GitHub tokens, and subsequently hijack a release pipeline on October 24, 2026.
organisation Hijack Release Pipeline
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline.
Tactical Metrics
Metrics
infrastructure
‎1.107.0
Software Version
UTC: LiteLLM version 1.107.0 gets published to PyPI on October 21, 2026, 11:46 a.m.
UTC: PyPI quarantines LiteLLM version 1.107.0.
What the Malicious Version of the Package Does Multiple reports have revealed that the files bundled with LiteLLM version 1.107.0 are engineered to execute automatically when Python starts, even if an application did not import LiteLLM.
Intelligence Sources
The Hacker News 2026-10-24