LiteLLM revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed a threat actor to push a malicious version of the popular Python package, triggering a widespread security crisis across the developer ecosystem.
According to LiteLLM developers Oliver Jensen and Mateo Wang, a configuration file was committed on May 27, 2026, to the public LiteLLM-Labs/lite-harness repository. The file inadvertently contained the master key to a deployment of the LiteLLM Agent Platform, an open-source tool utilized by the organization for orchestrating autonomous agents. Although the error was quickly identified and the commit was force-pushed over, and the exposed keys were identified as requiring revocation, key revocation did not occur for the critical master key.
The oversight left a vital access vector wide open. LiteLLM reported that an unknown attacker operating from the IP address 69.48.229[.]143 used this unrevoked master key months later on October 10, 2026. The unauthorized user gained access to the Agent Platform and extracted a GitHub CLI OAuth token configured within the service. This specific token allowed self-hosted cloud agents to file pull requests smoothly to GitHub repositories.
The security implications worsened because the token was not properly scoped down and remained closely associated with the GitHub organization owner’s account. Securing this token granted the attacker owner-level access across all repositories within the organization, enabling comprehensive credential exfiltration and unauthorized code deployment.
Under normal operating conditions, building and publishing a software release requires initiation by an authorized engineer alongside approval from a specialized account physically locked to a device within the company’s office. However, LiteLLM explained that this operational restriction had been relaxed earlier that week to accommodate a temporary push for more frequent software releases and bugfix backports. This relaxation allowed any two engineers to trigger and approve a release. Capitalizing on this window, the threat actor utilized one of the compromised tokens to trigger a release after repointing the deployer to a malicious repository, and used another token to approve it.
Project maintainers noted that the threat actor could have easily removed or loosened this release restriction entirely given their existing possession of an organization owner token. Investigators suspect this limitation was left intact deliberately to help evade immediate detection. Furthermore, LiteLLM confirmed that the malicious workflows were specifically designed to identify and exfiltrate additional keys and tokens, targeting upstream inference API tokens. In response to the breach, the company initiated a comprehensive remediation effort to revoke every single token associated with internal systems and third-party vendor platforms.
More Details About the Workflows Emerge
Independent investigations provided deeper visibility into the mechanics of the breach. Socket, an application security firm that published its own comprehensive timeline of the LiteLLM attack, revealed that researchers recovered two malicious commits that each added a rogue workflow file located at .github/workflows/cache.yml. The first commit was executed on October 10, 2026, at 10:11:45 p.m. UTC, followed quickly by a second commit on October 12.
According to Socket security researcher Karlo Zanki, neither of these commits was ever pushed to a persistent branch. Instead, both were sent to short-lived branches named using hexadecimal nomenclature (ci-tmp-<hex>) that were created, utilized, and deleted within a matter of minutes. This evasive technique ensured that the activity left virtually no traces behind in the repository’s ordinary historical logs.
Application security analysis of the repository’s activity logs showed that both malicious commits relied on a legitimate commit as their branch base, designed to make the push appear entirely harmless to casual observers.
As highlighted by LiteLLM, both workflows were heavily equipped to harvest GitHub tokens alongside API keys belonging to the organization’s Linear workspace, LiteLLM deployment, and Together AI, as well as the unique identifier and signing key of a GitHub App. The subsequent run on October 12 significantly broadened the scope of data collection to capture a wider array of sensitive credentials. This included API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian’s secret-scanning tenant. The harvesting script also gathered Playwright storage state, detailed PostgreSQL database information including connection strings, account names, and passwords, alongside Redis endpoint addresses, ports, and authentication passwords.
The sensitive data gathered through these dual workflows was automatically exfiltrated to external webhook endpoints. Security analysts emphasized the strategic value of the stolen credentials. A GitHub token and a GitHub App private key represent core platform access credentials rather than simple third-party service tokens, while a GitGuardian API key provides visibility into and potential control over the security alerts that would normally surface such suspicious activity. Similarly, serialized browser session storage states for end-to-end testing allow authenticated access to accounts like Linear without requiring a password or satisfying multi-factor authentication requirements.
These forensic findings ultimately disproved LiteLLM’s initial hypothesis that the GitHub CLI OAuth tokens had been stolen from the logs of an internal deployment. Acknowledging the evolving nature of the investigation, Jensen noted that security discoveries often challenge early assumptions, proving some initial beliefs to be inaccurate or incomplete as more data surfaces.
What the Malicious Version of the Package Does
Multiple cybersecurity analyses confirmed that the files bundled within LiteLLM version 1.107.0 were engineered to execute automatically the moment Python started up, even if an application never explicitly imported LiteLLM.
The injected malware featured two distinct execution paths. The first was a credential harvesting module targeting authentication material across a vast spectrum of developer tools, artificial intelligence applications, cloud environments, and web browsers. The second was a Unix-oriented backdoor designed to launch as a background process, regularly fetching and executing arbitrary code supplied by the attacker every hour.
The comprehensive credential stealer also swept up system information, SSH configuration files, Git and GitLab credentials and tokens, environment variables, and package manager tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo. Once gathered, this information was compressed and transmitted via an HTTP POST request to a domain registered just days prior on October 13, 2026.
Researchers with the Microsoft Security Research team emphasized the severe scope of the supply chain compromise. Because the startup files resided entirely outside the standard LiteLLM application directory, simply removing the application files themselves left the malicious startup components active on affected systems, meaning that initiating Python in an environment where the package had been present could immediately trigger the malicious payload.
