LiteLLM Uncovers How Leaked Master Key Led to Malicious Package Push and Software Supply Chain Compromise

LiteLLM developers have disclosed the detailed chain of events behind a major security breach, revealing that an Agent Platform master key accidentally published to a public GitHub repository late last May ultimately allowed an unknown threat actor to inject and push a malicious version of the popular Python package to the broader developer ecosystem.

The incident, which has drawn widespread attention across the software development and cybersecurity communities, began on May 27, 2026. According to LiteLLM maintainers Oliver Jensen and Mateo Wang, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository that inadvertently contained the master key for a deployment of the LiteLLM Agent Platform, an open-source orchestration tool utilized by the team to manage internal automated agents.

Although the error was identified rapidly by the development team and the offending commit was immediately force-pushed over, the exposure presented a lingering risk. While project maintainers recognized that the exposed keys required formal revocation, that critical security step was unfortunately missed for the master key itself, leaving a backdoor open into the system.

Months later, on October 10, 2026, an unknown attacker operating from the IP address 69.48.229.143 leveraged this unrevoked master key to gain unauthorized access to the Agent Platform. Once inside, the threat actor targeted and extracted a GitHub CLI OAuth token configured within the service. This token was designed to allow self-hosted cloud agents to seamlessly file pull requests to GitHub repositories. However, because the token was not properly scoped down and was directly associated with the organization owner’s account, it granted the intruder owner-level access across all repositories within the organization, alongside pathways for additional credential exfiltration.

The breach bypasses standard operational security controls that typically govern the release of software updates. LiteLLM noted that building and publishing a new release normally requires an authorized engineer to kick off the process, followed by approval from a specialized account physically locked to a dedicated device located within their corporate office.

However, this strict physical and procedural restriction had been temporarily relaxed earlier in the week to accommodate an urgent push for more frequent releases and bugfix backports. Under the relaxed temporary parameters, any two engineers were permitted to trigger and approve a release. Capitalizing on this window of opportunity, the threat actor utilized one of the compromised tokens to trigger a software release after repointing the deployer to their own malicious repository, and used a second token to approve it.

Furthermore, project maintainers observed that the threat actor possessed sufficient privileges to loosen these security restrictions even further or remove them entirely given their possession of an organization owner’s token. Investigators suspect this deliberate restraint was maintained simply to evade immediate detection and suspicion.

Subsequent forensic analysis revealed that the malicious workflows were specifically designed to identify and exfiltrate additional sensitive keys and tokens, placing a heavy focus on upstream inference API tokens. In the wake of the discovery, LiteLLM initiated a comprehensive response effort aimed at revoking every single token associated with all internal systems and vendor platforms.

These detailed findings effectively ruled out LiteLLM’s initial working hypothesis that the GitHub CLI OAuth tokens had been harvested from the logs of an internal LiteLLM deployment. Acknowledging the evolving nature of the forensic work, Jensen noted that the investigation was a continuous learning process in which initial assumptions and beliefs were periodically proven inaccurate or incomplete as more data surfaced.

More Details About the Workflows Emerge

Independent security analysis conducted by application security firm Socket provided further clarity regarding the mechanics of the attack. Socket researcher Karlo Zanki reported that the firm recovered two malicious commits, each of which added a rogue workflow file located at ".github/workflows/cache.yml." The initial commit occurred on October 10, 2026, at 10:11:45 p.m. UTC, followed by a second iteration on October 12.

Significantly, neither of these commits was pushed to a persistent branch. Instead, both were pushed to short-lived temporary branches with randomized hexadecimal identifiers that were created, utilized, and deleted within minutes. This deliberate transience ensured that the activity left virtually no trace within the ordinary commit history of the repository.

Analysis of repository activity logs demonstrated that both malicious commits relied on a legitimate commit as their branch base, cleverly designed to make the push appear entirely harmless to casual observers.

As highlighted by LiteLLM, both workflows were equipped to harvest a wide array of GitHub tokens and critical API keys, including credentials for the organization’s Linear workspace, LiteLLM deployments, and Together AI, as well as the unique identifier and signing key for an internal GitHub App.

The subsequent workflow run on October 12 significantly broadened the scope of harvested secrets. It swept up API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian’s secret-scanning tenant. It also captured Playwright storage state files, comprehensive PostgreSQL database connection strings, account names, passwords, and Redis endpoint configurations including ports and authentication passwords.

The data gathered during these automated workflow runs was exfiltrated directly to external webhook endpoints controlled by the attacker.

Security experts underscored the severe implications of the stolen credentials. Because a GitHub token and a GitHub App private key represent administrative controls for the platform hosting the source code rather than a third-party application, their compromise grants deep systemic visibility. Similarly, capturing the GitGuardian API key provided the attacker with potential oversight into alerts that would normally surface evidence of such unauthorized activity.

Additionally, researchers pointed out that the captured Playwright end-to-end storage state contained serialized browser session information, granting authenticated access to the associated Linear account without requiring a password or satisfying multi-factor authentication checks.

What the Malicious Version of the Package Does

The impact of the security breach culminated in the distribution of LiteLLM version 1.107.0 via the official Python Package Index (PyPI). Multiple security advisories revealed that the files bundled within this specific release were engineered to execute automatically the moment Python started on a machine, even if the host application never actually imported or utilized LiteLLM.

The embedded malware featured two distinct execution paths. The first was a credential harvesting module designed to comb through authentication materials across developer tools, artificial intelligence applications, cloud environments, and web browsers. The second was a Unix-oriented backdoor launched as a background process configured to fetch and execute arbitrary remote code supplied by the attacker on an hourly basis.

The stealer module was thorough, collecting broad system information, SSH configuration files, Git and GitLab credentials and tokens, environment variables, and authentication tokens associated with a vast array of package managers and development ecosystems including npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo. Once gathered, this information was compressed and transmitted via an HTTP POST request to a domain registered just days prior on October 13, 2026.

Security researchers with the Microsoft Security Research team emphasized that these mechanisms dramatically widened the potential exposure radius far beyond active deployments of LiteLLM. Because the malicious startup files were deposited outside the standard application directory, simply initiating a Python session in an affected environment was enough to activate the malicious code. Furthermore, remediation efforts required more than standard package removal, as cleaning only the application files would leave the malicious startup components intact on the host system.