Threat
LiteLLM supply chain attack started with an exposed master key
First reported theregister.com
Page published
Earliest dated coverage: 26 Oct 2026 · First observed: 26 Oct 2026 · Latest dated coverage: 26 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
LiteLLM's compromise demonstrates how unrevoked agent-platform secrets and privileged development tokens can turn trusted AI infrastructure into a distribution channel for credential theft and arbitrary code execution.
LiteLLM traced its malicious 1.107.0 release to a master key accidentally published in May and removed from GitHub without being revoked. An attacker used the key to access LiteLLM's agent platform, steal a GitHub CLI OAuth token, and gain repository-owner access before compromising release workflows. The poisoned PyPI package and container images carried a credential stealer and remote-access trojan; the PyPI version received approximately 49,000 downloads before quarantine.