LiteLLM details full attack chain behind malicious v1.107.0 PyPI release
jedisct1 · x · 2026-10-24
LiteLLM's security team published the canonical post-incident report on the compromised litellm==1.107.0 release pushed to PyPI and container registries on Oct 21.
Key findings:
- On May 27, 2026, a config file committed to the public lite-harness repo accidentally exposed the master key of the LiteLLM Agent Platform deployment; the leak was caught quickly, but the key was never actually revoked.
- The platform used an unscoped GitHub CLI OAuth token tied to the org (not a service account), giving the attacker GitHub Owner-level access.
- Via these credentials the threat actor published the malicious release to PyPI and registries.
LiteLLM acknowledges earlier status updates contained inaccuracies; this post is the source of truth, with affected artifacts covered in a separate incident report.
Related event: LiteLLM 1.107.0 Supply Chain Poisoning: Official Post-Mortem Published(5 posts)→
More from coding & agent
- Dev builds Supply Drop, a Grok-powered disaster recovery assistant with four practical desks — seanmcdonaldxyz · 2026-10-24
- LiteLLM 1.107.0 supply chain compromise: credential theft triggered by just starting Python — yuridiogenes · 2026-10-24
- Flint 40B empty-think bug traced to chat template ignoring enable_thinking=false — tydsh · 2026-10-24
- When did 'what's your tech stack' become a list of model names? — victor_explore · 2026-10-24
- Claude Code's two key figures clarified: Boris Cherny leads the product line — op7418 · 2026-10-24
- Claude Code Engineer Leaves Anthropic After a Year as the Tool Scaled Beyond Expectations — trq212 · 2026-10-24