INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs

| 2026-10-22 08:28 CRITICAL HIGH DATA BREACH SUPPLY CHAIN
JSON
Executive Summary
AI-generated
On October 21, 2026, around 4:00 a.m. PST, threat actors compromised LiteLLM's release pipeline to push a malicious version of the Python package containing a credential stealer and a backdoor. The incident affected users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0, latest, main-latest, or main-stable between 11:46 a.m. and 2:20 p.m. UTC, totaling approximately 3 hours of exposure time. The attackers validated AWS instance role credentials captured from compromised CI runners and Kubernetes nodes from IP addresses 168.100.8[.]57 and 165.227.201[.]8, starting about 4.5 hours post-exfiltration. Wiz observed abuse of stolen credentials, with the attacker using a dual-technique approach to execute arbitrary code from a remote server every hour, turning it into a remote access trojan (RAT).
Technical Mitigations AI-generated
• Patch the Python interpreter to prevent execution of "<a href="/auth/login?next=/detail/kuRCaKEBv3K6n0loHZYK" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a>" and "privcollect" • Block or hunt for HTTP POST requests to "<a href="/auth/login?next=/detail/kuRCaKEBv3K6n0loHZYK" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a>/healthcheck" • Use a secure Docker image with immutable release tags
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 6 IoCs Create Free Account
li•••••.dev
co•••••.py
do•••••.txt
si•••••.py
168.100.•••.•••
165.227.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
TeamPCPTeamPCP
Target & Sectors
Global Scope technologytechnology
Incident Timeline
‎March 2026
Threat actors used a ".pth" file to launch the stealer program in an incident similar to TeamPCP's March 2026 attack, but no direct connection has been established between this incident and the previous one.
threat_actor TeamPCP
The use of a ".pth" file to launch the stealer program is notable as it mirrors the modus operandi observed in the March 2026 attack attributed to TeamPCP.
organisation RSA
"The embedded RSA public keys differ, as do the exfiltration implementation and backdoor behavior.
organisation 1.107.0
If 1.107.0 ran anywhere in your environment, rotate every reachable credential and rebuild."
organisation The Hacker News
However, Socket told The Hacker News that there is no evidence at this stage to link the two incidents.
organisation Socket
"The public evidence reviewed so far doesn't establish a connection to the March attack," Socket said.
‎October 19, 2026
An attacker with access to three sets of developer GitHub CLI credentials, including one that granted the ability to run GitHub workflows, temporarily expanded LiteLLM's release permissions for two internal engineers on October 19, 2026.
industry Technology
General Document Context
organisation GitHub
The attacker had access to three sets of developer GitHub CLI credentials, including one that had the ability to run GitHub workflows.
‎October 21, 2026
Threat actors compromised LiteLLM's release pipeline to push a malicious version, 1.107.0, to the Docker Hub registry and PyPI repository via leveraged GitHub CLI credentials.
industry Technology
General Document Context
infrastructure 1.107.0
On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository.
tactic T1059.006 - Python
On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository.
organisation PyPI
On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository.
infrastructure 107.0
The following compromised versions were published - LiteLLM v1.107.0 (PyPI) v1.107.0, latest, main-latest, and main-stable (Docker) v1.107.0, latest, main-latest, and main-stable (GHCR) Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0,
organisation UTC
The following compromised versions were published - LiteLLM v1.107.0 (PyPI) v1.107.0, latest, main-latest, and main-stable (Docker) v1.107.0, latest, main-latest, and main-stable (GHCR) Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0,
infrastructure Linux
In addition, the interpreter attempts to execute "sitecustomize.py," which runs only on Linux and macOS machines, and is configured to fetch "domain.txt" from a now-removed GitHub dead drop ("github[.]com/letters9813").
infrastructure Macos
In addition, the interpreter attempts to execute "sitecustomize.py," which runs only on Linux and macOS machines, and is configured to fetch "domain.txt" from a now-removed GitHub dead drop ("github[.]com/letters9813").
organisation PST
PST.
organisation ListModels
ListFoundationModels and a ListModels call, consistent with LLMjacking," Wiz added.
organisation LLMjacking
ListFoundationModels and a ListModels call, consistent with LLMjacking," Wiz added.
organisation IAM
"In a small number of environments, the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and performed general discovery (ListAccounts, DescribeTrails, etc.).
organisation ListRoles
"In a small number of environments, the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and performed general discovery (ListAccounts, DescribeTrails, etc.).
organisation ListUsers
"In a small number of environments, the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and performed general discovery (ListAccounts, DescribeTrails, etc.).
organisation ListAccounts
"In a small number of environments, the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and performed general discovery (ListAccounts, DescribeTrails, etc.).
organisation DescribeTrails
"In a small number of environments, the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and performed general discovery (ListAccounts, DescribeTrails, etc.).
organisation CLI
However, after the open-source project maintainers temporarily expanded release permissions to allow two internal engineers to publish daily bugfix backports for customers, the attacker leveraged their access to three sets of developer GitHub CLI credentials to ultimately push a malicious version.
‎2026/10/22
Threat actors compromised multiple independent security controls to push a malicious version of the Python package containing a credential stealer and a backdoor.
organisation CI
Wiz said it has since observed abuse of stolen credentials, starting about 4.5 hours post-exfiltration, with the attacker validating AWS instance role credentials captured from compromised CI runners and Kubernetes nodes from the following IP addresses between 4:20 p.m. and 5:01 p.m. UTC - 168.100.8[.]57 165.227.201[.]8 "Each credential was checked with sts:GetCallerIdentity, followed…
organisation Kubernetes
Wiz said it has since observed abuse of stolen credentials, starting about 4.5 hours post-exfiltration, with the attacker validating AWS instance role credentials captured from compromised CI runners and Kubernetes nodes from the following IP addresses between 4:20 p.m. and 5:01 p.m. UTC - 168.100.8[.]57 165.227.201[.]8 "Each credential was checked with sts:GetCallerIdentity, followed…
organisation IP
Wiz said it has since observed abuse of stolen credentials, starting about 4.5 hours post-exfiltration, with the attacker validating AWS instance role credentials captured from compromised CI runners and Kubernetes nodes from the following IP addresses between 4:20 p.m. and 5:01 p.m. UTC - 168.100.8[.]57 165.227.201[.]8 "Each credential was checked with sts:GetCallerIdentity, followed…
infrastructure 1.107.0
" Developers are advised to remove LiteLLM 1.107.0 from their machines, isolate hosts on which the malicious version was installed, hunt for the malicious Python artifacts, block access to the exfiltration domain, rotate all credentials, and investigate the execution of "/codepy." "A single compromised install can hand an attacker the ability to push malicious code downstream," JFrog securit…
organisation raw[.]githubusercontent[.]com/letters9813
"Every hour, the daemon fetches the attacker's current C2 domain from a GitHub repository (raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt), then fetches and executes a Python payload from According to Google-owned cloud security subsidiary Wiz, the text file was only populated with initial test values prior to its takedown by GitHub around 1:30 p.m. UTC.
organisation domain[.]txt
"Every hour, the daemon fetches the attacker's current C2 domain from a GitHub repository (raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt), then fetches and executes a Python payload from According to Google-owned cloud security subsidiary Wiz, the text file was only populated with initial test values prior to its takedown by GitHub around 1:30 p.m. UTC.
organisation Suspects GitHub
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release.
Tactical Metrics
Metrics
infrastructure
‎1.107.0
Software Version
" Developers are advised to remove LiteLLM 1.107.0 from their machines, isolate hosts on which the malicious version was installed, hunt for the malicious Python artifacts, block access to the exfiltration domain, rotate all credentials, and investigate the execution of "/codepy." "A single compromised install can hand an attacker the ability to push malicious code downstream," JFrog securit…
On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository.
If 1.107.0 ran anywhere in your environment, rotate every reachable credential and rebuild."
Metrics
infrastructure
‎107.0
Software Version
The following compromised versions were published - LiteLLM v1.107.0 (PyPI) v1.107.0, latest, main-latest, and main-stable (Docker) v1.107.0, latest, main-latest, and main-stable (GHCR) Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0,
Metrics
infrastructure
‎Linux
Affected Product
In addition, the interpreter attempts to execute "sitecustomize.py," which runs only on Linux and macOS machines, and is configured to fetch "domain.txt" from a now-removed GitHub dead drop ("github[.]com/letters9813").
Metrics
infrastructure
‎Macos
Affected Product
In addition, the interpreter attempts to execute "sitecustomize.py," which runs only on Linux and macOS machines, and is configured to fetch "domain.txt" from a now-removed GitHub dead drop ("github[.]com/letters9813").
Intelligence Sources
The Hacker News 2026-10-22