LiteLLM attack traced to a key left live for five months
The malicious 1.107.0 release of popular AI gateway LiteLLM traces back to a master key pushed to a public repository in May and never revoked. The poisoned package was downloaded about 49,000 times in under two hours.
What happened
LiteLLM is an open-source Python library and gateway that lets apps reach OpenAI, Anthropic, Google and other providers through one interface. A late-October postmortem explained how version 1.107.0, published to PyPI on 21 October, was poisoned. On 27 May a LiteLLM Agent Platform master key was committed to a public GitHub repository. The commit was overwritten but the key was never revoked; The Register says it stayed valid for 136 days.
The attack chain
On 10 October the attacker used the key to obtain an organisation-owner GitHub CLI token. The release was built from a lookalike repository, Berri-AI/litellm, and published at 11:39 UTC; Ostorlab says it was quarantined at 13:23. Wiz counted about 49,000 downloads. The package carried an infostealer and a remote access trojan that ran whenever Python started, even if LiteLLM was never imported.
Second incident this year
StepSecurity notes LiteLLM's 1.82.7 and 1.82.8 releases were compromised in March. Because it sits between apps and model providers, compromising it exposes many companies' API keys at once.
Attackers want the model API keys and cloud credentials stored on systems that run LiteLLM: stolen keys let them bill expensive usage to victims and reach company data. The high download count in so short a window shows how many environments update dependencies automatically to the newest release.
Key terms
A supply-chain attack reaches targets through a component they trust. Key rotation means revoking and replacing secrets; deleting a key from git history does not make it safe. Version pinning locks dependencies to audited releases.
What comes next
Arrakis found 44% of examined agents inactive for 180+ days yet holding live credentials. Expect stricter trusted-publisher checks on package registries.
One forgotten step in May affected tens of thousands of systems in October. Continuous secret scanning on code repositories would have caught the exposed key within minutes.
What it means for your business
- If you installed 1.107.0, rebuild and rotate every secret from a clean machine.
- Pin AI library versions and update deliberately.
- Revoke leaked keys immediately; deleting the commit is not enough.