Unrevoked GitHub key enabled LiteLLM breach and malicious package release

LiteLLM traced last week’s supply chain attack to a master key accidentally committed to a public GitHub repository in May. Although developers removed the exposed commit, they did not revoke the key; an attacker later used it to gain broad access to company repositories and publish a malicious version of the AI gateway.

The poisoned LiteLLM 1.107.0 package was available for less than two hours but received about 49,000 downloads, according to Wiz. It contained an infostealer and a remote access trojan that could steal browser data, cloud credentials and AI provider API keys. LiteLLM is revoking internal and vendor tokens, and advises anyone who ran the affected version to investigate systems and rotate accessible credentials.