LiteLLM traces its compromised release to an exposed key that stayed valid
LiteLLM’s completed investigation says an exposed agent-platform master key was identified but never revoked. An attacker used it to obtain an organization owner’s GitHub token, acquire more credentials and redirect the release workflow to malicious source. Compromised version 1.107.0 reached PyPI and container registries on October 21 before removal. The report supersedes earlier explanations and shows why deleting a leaked secret from Git is insufficient.
LiteLLM · Oct 23, 2026
Why it matters
Release approval and signing cannot establish trustworthy source when an attacker controls the identities and workflow behind them.
More context
Check the incident notice against installed versions, image digests and deployment times. Its recovery guidance covers rebuilding affected environments and rotating reachable secrets. Python startup hooks mean merely running pip in a contaminated environment can execute the payload again.
Keep in mind
This is the vendor’s investigation, supported by separate artifact analysis. It does not establish compromise of every LiteLLM version or its private enterprise registry.
Original read