· ai-devtools
LiteLLM exposes master key, leading to supply chain attack via PyPI version 1.107.0
The compromised package, version 1.107.0, contained an infostealer and a remote access trojan capable of executing arbitrary code on infected machines.
This poisoned version of the popular open source AI gateway was uploaded to PyPI and its container registries last Wednesday. During the less than two hours it was available on PyPI, Wiz reported it garnered approximately 49,000 downloads.
LiteLLM detailed the full attack sequence on Friday, tracing it back to May 27. On that date, a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. This key belonged to an internal tool LiteLLM used for orchestrating AI agents.
Although the project developers swiftly noticed the mistake and removed the exposed commit, they neglected to revoke the master key. According to Friday’s postmortem, “On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token.”
This token afforded the attacker owner-level access across all of LiteLLM’s GitHub repositories. This is particularly concerning because GitHub CLI tokens are “post-2fa,” meaning they bypass the standard sudo mode authentication flows required for major repository actions.
The token enabled the attacker to author malicious commits in internal branches, including workflows designed to steal any tokens and secrets available during the continuous integration development process. Furthermore, they managed to steal GitHub CLI OAuth tokens belonging to two engineers who held maintainer privileges, alongside tokens for several other internal systems.
LiteLLM observed, “Reviewing the actor's activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens.” Because the attacker had seized several privileged identities, their actions appeared legitimate, as all approvals and changes seemed to originate from credentialed engineers.
In response to the breach, LiteLLM’s team is currently revoking every token linked to every internal system and vendor platform. They noted, “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key.”
The hidden infostealers within the compromised package were engineered to collect sensitive data, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari. They also swept up AWS credentials, Google Cloud Platform service account keys, Microsoft Azure tokens, and API keys for OpenAI, Anthropic, Cohere, and other LLM providers. If version 1.107.0 was installed and run, assume any credentials accessible to that system may have been stolen. Users are advised to investigate affected systems, change passwords, and rotate exposed keys.
