# LiteLLM supply chain attack: exposed GitHub master key led to trojanized PyPI release

> **Key takeaway:** An unrevoked master key committed to a public GitHub repository in May enabled attackers to gain owner-level repository access and distribute a trojanized LiteLLM package that was downloaded approximately 49,000 times in under two hours.

**Published:** 2026-10-26T20:30:53+00:00 
**Source:** The Register 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/litellm-supply-chain-attack-exposed-github-master-key-led-to.html 

## Summary
LiteLLM, a widely used open source AI gateway, disclosed that a supply chain attack last week originated from a master key accidentally committed to a public GitHub repository on May 27. The key, belonging to an internal AI agent orchestration tool called lite-harness, was removed from the repository but never revoked. On October 10, a threat actor used this key to access the LiteLLM Agent Platform, extract a GitHub CLI OAuth token, and gain owner-level access to all organization repositories.

The attacker leveraged this privileged access to inject malicious commits into CI workflows, steal additional tokens from two maintainer-level engineers, and ultimately publish a trojanized version 1.107.0 to PyPI and container registries. The compromised package contained both an infostealer and a remote access trojan capable of arbitrary code execution. It remained available for less than two hours but accumulated approximately 49,000 downloads according to Wiz. The malware targeted credentials across multiple browsers, cloud providers (AWS, GCP, Azure), and LLM services including OpenAI, Anthropic, and Cohere.

## Attack chain and technical exposure
- **Exposed credential lifecycle failure:** The master key was committed to the public `LiteLLM-Labs/lite-harness` repository on May 27, visually removed from the commit history, but never formally revoked, leaving it valid for over four months.
- **GitHub CLI OAuth token privilege escalation:** The stolen token provided "post-2fa" access, bypassing GitHub's sudo mode authentication flows that normally protect high-impact repository actions, granting immediate owner-level permissions.
- **CI/CD pipeline compromise:** Attackers authored malicious commits into branches containing workflows specifically designed to harvest tokens and secrets exposed during continuous integration runs, enabling lateral movement to additional engineer accounts.
- **Trojanized package distribution:** Version 1.107.0 uploaded to PyPI and container registries contained both an infostealer and a remote access trojan with arbitrary code execution capabilities, targeting cross-platform credentials.
- **Multi-vector credential harvesting:** The infostealer extracted browser data from Chrome, Firefox, Edge, and Safari; cloud credentials from AWS, GCP, and Azure; and API keys from OpenAI, Anthropic, Cohere, and other inference providers.

## Why it matters
This incident demonstrates how a single unrotated secret in an open source project's public repository can cascade into a full organizational compromise, affecting downstream users through trusted package managers like PyPI. For Linux system administrators and developers using LiteLLM in AI/ML pipelines, the attack highlights critical gaps in secret management practices and the particular danger of GitHub CLI tokens that bypass secondary authentication checks. The scale of downloads in under two hours also underscores the velocity at which compromised open source packages can propagate through automated dependency resolution in container and Python environments.