OPEN LINK ↗
// 1h agoSECURITY INCIDENT
LiteLLM Secret-Stealing Workflows Precede Attack
Socket found malicious GitHub Actions workflows exfiltrating LiteLLM secrets on October 10 and 12—11 days before attackers published the compromised 1.107.0 release to PyPI and Docker. LiteLLM’s investigation links a stolen GitHub token to the later release approval. ([Socket](https://www.socket.dev/blog/litellm-attack-timeline), [LiteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain))
// ANALYSIS
This was an organization and CI/CD takeover that culminated in a poisoned package, not an isolated dependency compromise.
- –The extended compromise window means defenders must investigate GitHub organization activity from October 10 onward, not only scan for version 1.107.0.
- –LiteLLM’s gateway role magnified the blast radius because deployments commonly hold model-provider keys, cloud credentials, and tenant configuration.
- –The malicious package executed through Python startup hooks, so affected environments could be exposed even when applications never imported LiteLLM. ([Microsoft Security](https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/))
- –Short-lived branches, deleted workflow runs, stolen maintainer tokens, and a lookalike repository show why branch protection and build provenance alone are insufficient.
- –Teams should rotate credentials, inspect CI runners and container images, and treat all secrets accessible to affected environments as exposed.
// TAGS
litellmllmapisecurityci-cdopen-sourcedevtool
DISCOVERED
1h ago
2026-10-24
PUBLISHED
1h ago
2026-10-24
RELEVANCE
9/ 10
AUTHOR
rst_cloud