LiteLLM: Definitive incident chain behind compromised v1.107.0

Evidence record

Read the original source ↗

Claim-level citations (4)

• supportsLiteLLM 1.107.0 turned trusted distribution into AI credential theft: LiteLLM reports that an unreclaimed Agent Platform master key exposed in a public repository on May 27 became the initial credential enabling an October 10 access, followed by compromise of GitHub organization release privileges.

  Attack chain: exposed LiteLLM Agent Platform master key and GitHub organization compromise

• supportsLiteLLM 1.107.0 turned trusted distribution into AI credential theft: LiteLLM says a May 27 public commit exposed its Agent Platform master key, the key was not revoked, and an actor used it on October 10 to retrieve a GitHub owner CLI OAuth token.

  Narrative; GitHub Owner Access

• supportsLiteLLM 1.107.0 turned trusted distribution into AI credential theft: The compromised release path made an authenticated distribution artifact unreliable as evidence of benign build inputs; separate host-level execution and credential-use checks are needed to determine impact.

  Building and Signing the Malicious Release

• supportsLiteLLM 1.107.0 turned trusted distribution into AI credential theft: LiteLLM's own reconstruction places the seven malicious PyPI wheels online from 11:39 to 13:23 UTC on October 21, 2026, and compromised Docker images available until about 14:20 UTC.

  Incident timeline: PyPI and Docker distribution windows