LiteLLM traces its poisoned release to an agent platform key leaked in May

Oct 26, 7:00 a.m. ET

Affected: LiteLLM 1.107.0 from PyPI and container images built with it. All versions and fixes

LiteLLM says the attacker who published its poisoned 1.107.0 release on Oct 21 got in with a master key for an internal agent platform. The key was committed to a public GitHub repository on May 27 and never revoked. The key let the attacker take a GitHub organization owner’s token on Oct 10 and steal two maintainers’ tokens through throwaway workflows. Microsoft has published Defender detections, hunting queries and new indicators for the release.

The key belonged to the LiteLLM Agent Platform, an experimental tool for agents that open pull requests. LiteLLM says the platform held an unscoped GitHub CLI token belonging to its organization owner rather than a service account, and its API returned that token to the attacker. GitHub CLI tokens aren’t subject to GitHub’s two-factor reauthentication for sensitive actions, LiteLLM says.

With the owner’s token, the attacker pushed branches whose workflows posted repository secrets to an outside endpoint, then deleted the runs. On Oct 21, after repointing the release to a malicious repository, the attacker used one stolen token to start it and another to approve it. LiteLLM had relaxed its release approvals that week to allow any two engineers. Its first post had suspected logs from an internal deployment.

Microsoft’s analysis gives advanced hunting queries for Defender XDR that look for connections to the collector domain, the malicious files’ hashes and the stealer’s database reads and encryption. It lists Defender detections, an exposure entry, TVM-2026-0003, and the GitHub address the loader checks for a second-stage server. That file was empty when researchers looked.

LiteLLM says it saw the attacker hunting for upstream AI provider tokens in other internal systems, and it’s revoking every token tied to its internal systems and vendor platforms.

Vendor: LiteLLM

What to do

8 steps

1Find every copy of LiteLLM 1.107.0 in installed environments, uv and pip caches, internal package mirrors, lock files, build outputs and container images, as Microsoft advises.
2Check package files against the 1.107.0 wheel hashes in the indicators.
3Isolate affected hosts and inspect them from a known-clean system, without running python or pip on them.
4Rebuild affected environments from verified artifacts, confirming that cook.pth, cook.py and sitecustomize.py are gone from the library path.
5From a known-clean machine, rotate the model provider keys, cloud, CI/CD, source control and registry credentials, SSH keys and the proxy’s DATABASE_URL that affected hosts could reach.
6Revoke the affected identities’ sessions, since rotating a password or key doesn’t end every active session, Microsoft says.
7Run Microsoft’s advanced hunting queries in Defender XDR for the collector domain, the file hashes and the stealer’s database reads.
8Search proxy and DNS logs for requests to the dead-drop address in the indicators, which the loader checks for a second-stage server.

Affected and fixed versions

Product	Affected	Fixed
litellm on PyPI and LiteLLM container images	`1.107.0`	Rebuild from verified artifacts

Product
litellm on PyPI and LiteLLM container images
Affected
1.107.0
Fixed
Rebuild from verified artifacts

Indicators

URLs and IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
URL		Dead drop the loader reads for a second-stage server, per Microsoft
IP address		Called LiteLLM’s agent platform with the leaked key on Oct 10
SHA-256		Poisoned wheel for macOS on x86_64
SHA-256		Poisoned wheel for macOS on arm64
SHA-256		Poisoned manylinux wheel for aarch64
SHA-256		Poisoned manylinux wheel for x86_64
SHA-256		Poisoned musllinux wheel for aarch64
SHA-256		Poisoned musllinux wheel for x86_64
SHA-256		Poisoned wheel for Windows on amd64

URLDead drop the loader reads for a second-stage server, per Microsoft
IP addressCalled LiteLLM’s agent platform with the leaked key on Oct 10
SHA-256Poisoned wheel for macOS on x86_64
SHA-256Poisoned wheel for macOS on arm64
SHA-256Poisoned manylinux wheel for aarch64
SHA-256Poisoned manylinux wheel for x86_64
SHA-256Poisoned musllinux wheel for aarch64
SHA-256Poisoned musllinux wheel for x86_64
SHA-256Poisoned wheel for Windows on amd64

Timeline

May 27A configuration file holding the agent platform’s master key is committed to a public LiteLLM-Labs repository.
Oct 10The attacker uses the key to take the owner’s GitHub CLI token, then runs workflows that post two maintainers’ tokens to an outside endpoint.
Oct 12The attacker runs workflows on private repositories that post all their secrets.
Oct 21The attacker repoints the release and publishes 1.107.0 to PyPI and the container registries.
Oct 23LiteLLM publishes its account of the attack chain, and Microsoft publishes its analysis.

Sources

LiteLLM noticePrimary source docs.litellm.ai
Microsoft researchPrimary source microsoft.com