LiteLLM Supply-Chain Attack Uses Exposed Master Key to Publish Credential-Stealing Release

Attackers published malicious LiteLLM version 1.107.0 to PyPI and a compromised container image on October 21, 2026, after exploiting a master key reportedly exposed and left unrevoked since May. They obtained an owner-level GitHub token, collected additional maintainer tokens, and bypassed the two-approver release requirement by redirecting the release workflow to an attacker-controlled repository. The release remained available for approximately two hours, during which ClickPy recorded 50,000 downloads—not necessarily unique compromised systems. Its privcollect payload stole browser secrets, cloud credentials, AI-provider API keys, and private keys; database-backed proxies also reportedly exposed tables containing stored provider keys. Wiz reported use of stolen credentials beginning four hours and 30 minutes after exfiltration, including validation of AWS credentials taken from CI runners and Kubernetes nodes.

This was LiteLLM’s second reported compromise of the year. In March, attackers attributed to TeamPCP used a publishing token stolen through a compromised Trivy scanner in LiteLLM’s CI/CD pipeline to distribute versions 1.82.7 and 1.82.8. Those releases harvested secrets, established persistence, and attempted Kubernetes lateral movement; version 1.82.8 also used a Python startup hook that could execute on every interpreter launch. The incidents expose AI gateways as concentrated credential-theft targets, even when deployed to improve provider availability. Organizations should identify affected installations and images, isolate exposed workloads, rotate accessible credentials, investigate persistence and cloud activity, and rebuild compromised environments from trusted sources. Release controls should enforce least-privilege tokens and independent approval, while resilience testing should verify genuinely independent gateway and model-provider fallback paths.