Affected Systems

LiteLLM Python package version 1.107.0 (published October 21, 2026 to PyPI, Docker Hub, and GHCR). Threat actor gained owner-level access to BerriAI GitHub organization via unrevoked master key exposed May 27, 2026. Malicious release pipeline pushed compromised package from lookalike repository "Berri-AI/litellm". Downstream users who installed v1.107.0 between October 21, 2026 11:46 a.m. UTC and quarantine at 1:23 p.m. UTC are potentially affected.

Exploitation Status

Actively exploited. Threat actor (IP 69.48.229[.]143) leveraged leaked master key on October 10, 2026, extracted GitHub OAuth tokens with owner privileges, and successfully published malicious LiteLLM v1.107.0 to PyPI on October 21, 2026. Malicious workflows exfiltrated credentials for GitHub, Linear, Together AI, Anthropic, OpenAI, AWS Bedrock, Tavily, GitGuardian, PostgreSQL, and Redis via webhook[.]site endpoints. PyPI quarantined the package within 1.5 hours of publication after researcher disclosure.

Business Impact

Organizations using LiteLLM v1.107.0 face immediate credential theft risk. Malicious workflows harvested GitHub tokens, LLM API keys (OpenAI, Anthropic, AWS Bedrock), database credentials (PostgreSQL, Redis), and internal service tokens. Compromised credentials enable unauthorized access to AI inference platforms, source code repositories, databases, and third-party services. LiteLLM is revoking all internal tokens; downstream users must audit installations between October 21 11:46-13:23 UTC and rotate any credentials accessible to compromised environments. Supply chain integrity compromised via branch protection override and release pipeline manipulation.

Urgency

đŸ”´ Immediate

Recommended Actions

  • Immediately audit all systems for LiteLLM v1.107.0 installations (check pip freeze, Docker images with tags v1.107.0, latest, main-latest, main-stable from October 21, 2026). Uninstall and upgrade to verified clean version.
  • Rotate all API keys and credentials for OpenAI, Anthropic, AWS Bedrock, Together AI, Tavily, GitGuardian, and any LLM inference services accessible from environments running LiteLLM v1.107.0.
  • Review GitHub audit logs for repositories where LiteLLM v1.107.0 was deployed. Search for unauthorized commits, workflow runs, or OAuth token usage between October 10-21, 2026.
  • Inspect PostgreSQL and Redis database access logs for anomalous connections or data exfiltration from systems running the compromised package.
  • Monitor network traffic for connections to webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37 and webhook[.]site/4da03473-a3e7-4d from your environment. Block webhook[.]site at perimeter if not business-critical.

---

# Threat Actor Context

Actor Profile

The threat actor behind this campaign remains unidentified. Operating from IP address 69.48.229[.]143, the actor demonstrated sophisticated understanding of CI/CD pipeline security, GitHub Actions workflows, and supply chain attack methodologies. Their motivation appears to be credential harvesting and potential downstream compromise of LiteLLM users. The actor exhibited strong operational security by using throwaway branches, deleting workflow runs, and timing actions to evade detection. The attack vector originated from exploitation of an accidentally exposed LiteLLM Agent Platform master key published to a public GitHub repository on May 27, 2026, which remained unrevoked despite identification of the exposure.

TTPs (Tactics, Techniques, Procedures)

The actor employed multi-stage credential theft and supply chain compromise techniques. Initial access (T1078 - Valid Accounts) was achieved via an unrevoked master key to gain access to the Agent Platform. The actor then performed credential dumping (T1552.001 - Credentials in Files) by extracting a GitHub CLI OAuth token with owner-level privileges. They executed malicious GitHub Actions workflows (T1059 - Command and Scripting Interpreter) via throwaway branches to harvest additional engineer tokens through attacker-controlled webhook[.]site endpoints. The actor modified CI/CD pipelines (T1554 - Compromise Client Software Binary) by overriding branch protection, redirecting the release source to a lookalike repository (Berri-AI/litellm vs BerriAI/litellm), and publishing malicious package version 1.107.0 to PyPI and Docker Hub. Defense evasion (T1070.004 - File Deletion) was achieved by deleting workflow runs and branches within minutes of execution. The workflows targeted extensive credential exfiltration including API keys for Anthropic, OpenAI, AWS Bedrock, Linear, Together AI, GitGuardian, PostgreSQL credentials, Redis authentication, and Playwright storage state.

Targets & Patterns

The campaign specifically targeted LiteLLM, an open-source Python package serving as a large language model (LLM) gateway, impacting the software development and cloud services sectors. The actor's primary objective was credential harvesting from the development infrastructure, with secondary impact on downstream users who installed the compromised version 1.107.0. The targeting pattern suggests the actor sought to compromise AI/ML infrastructure and gain access to upstream inference API tokens from major LLM providers (Anthropic, OpenAI, AWS Bedrock). The choice of LiteLLM as a target is significant given its role as middleware in AI application stacks, providing potential access to numerous organizations' AI infrastructure and API credentials. The attack exploited a temporary relaxation of release approval restrictions that allowed any two engineers to trigger and approve releases, suggesting the actor monitored the repository for operational security weaknesses.

Historical Context

This incident represents a sophisticated supply chain attack against Python package infrastructure, following established patterns seen in previous PyPI compromises but with notable CI/CD pipeline manipulation techniques. The attack timeline spans from the initial key exposure on May 27, 2026, through exploitation on October 10, 2026, to the malicious release on October 21, 2026—demonstrating patient reconnaissance over nearly five months. The use of lookalike repository names (Berri-AI vs BerriAI) echoes typosquatting techniques, while the GitHub Actions workflow abuse represents an evolution in supply chain attack methodologies. The incident was detected and reported by Upwind researcher Lidor Machluf, with PyPI quarantining the malicious version within approximately 1 hour and 17 minutes of publication. No direct links to previously documented campaigns or threat actors are established in the available data.

Defensive Recommendations

  • Implement automated secret scanning and immediate revocation workflows for any credentials exposed in public repositories, ensuring master keys and high-privilege tokens are revoked within minutes of detection rather than relying on manual processes
  • Monitor GitHub Actions workflow modifications and enforce strict branch protection rules that cannot be overridden even by organization owners; alert on any changes to .github/workflows/ paths, especially on throwaway or short-lived branches matching patterns like ci-tmp-*
  • Scope OAuth tokens and service account credentials to minimum required permissions; avoid associating CI/CD tokens with organization owner accounts and implement time-limited, purpose-specific credentials for release pipelines
  • Deploy egress filtering and monitoring for CI/CD environments to detect exfiltration attempts to suspicious domains like webhook[.]site; baseline normal network behavior and alert on connections to known data exfiltration services
  • Enforce multi-party approval for release pipeline changes with physical device authentication requirements, and maintain audit logs of all workflow executions including deleted runs; implement immutable logging to prevent threat actors from covering their tracks via T1070.004 techniques