Zero Radar
← feed
CriticalSecurity incidentupdated 26 Oct 2026, 12:04 UTC

LiteLLM supply-chain attack stole CI secrets over at least 11 days

A popular AI developer tool was compromised by attackers who secretly ran programs that collected passwords and access keys from its build system. Anyone who installed a bad version of the package could have had their own credentials stolen

Attacks reported (Socket, The Record)3 independent sources
SeverityCriticalSecurity incident
Being exploited?ReportedBy Socket, The Record, not officially confirmed yet
What to doCheck exposureFind and remove litellm==1.107.0 and the malicious container image, then rotate all secrets that those installs or your CI could access.
How sure is this?3 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Master key leakedConfig file with key committed publicly in May
  2. 2Malicious workflowscache.yml ran secret-stealing jobs Oct 10-12
  3. 3Release pipeline hijackedAttacker published tampered package
  4. 4Users install bad versionlitellm==1.107.0 from PyPI and container image
  5. 5Secrets exfiltratedCI and user credentials sent to attacker
  6. ResultAttacker harvests credentials from many users

What happened

Malicious workflows at .github/workflows/cache.yml were committed to the BerriAI/litellm GitHub repository and ran successfully on October 10 and October 12, 2026, designed to collect and transmit CI secrets. This preceded the October 21 release-pipeline attack that published malicious litellm==1.107.0 packages to PyPI and a malicious container image. An earlier exposed master key, accidentally committed to a public repository in May 2026, reportedly let the attacker reach the release pipeline.

Why it is dangerous: The stolen CI secrets could include GitHub tokens and other credentials that give access to repositories and release systems. Developers and organizations that installed litellm 1.107.0 or used the affected container image may have had their own secrets exposed, and reports say tens of thousands of users were hit.

Are you affected?

You are affected if you installed litellm==1.107.0 from PyPI, pulled the malicious LiteLLM container image, or your organization's CI pipelines or GitHub tokens were connected to the BerriAI/litellm repository.

litellm==1.107.0 (PyPI wheels); malicious LiteLLM container image published October 21, 2026; BerriAI/litellm repository CI secrets during October 10-21, 2026.

What to do

  1. Check whether litellm==1.107.0 or the affected container image is installed anywhere and remove it.
  2. Rotate GitHub tokens, CI secrets, and any API keys that were available to LiteLLM's build or release pipelines.
  3. Revoke the leaked LiteLLM master key and confirm no other keys from the exposed configuration file remain active.
  4. Review GitHub Actions logs and repository history for unexpected cache.yml workflows or ci-tmp- branches.

Timeline

  1. 23 Oct 2026, 21:00 UTC
    Publicly disclosed
  2. 23 Oct 2026, 21:00 UTC
    Reported by Socket · Socket
  3. 24 Oct 2026, 11:03 UTC
    Reported by The Hacker News · The Hacker News
  4. 26 Oct 2026, 12:04 UTC
    The Record reported on it · The Record

Sources 3 reports, oldest first

Security researchers research teams and mailing lists

Security press established security newsrooms

Technical details

ID
ZR-3baf29b2 · ZR-3a1a036e · ZR-680a1bde
Disclosed
23 Oct 2026, 21:00 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 12:04 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

LiteLLM supply-chain attack stole CI secrets over at least 11 days · Zero Radar