LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM Python package compromised with credential stealer and backdoor via suspected GitHub token leak.
Run LiteLLM?
Get an email when a reviewed story names LiteLLM, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
LiteLLM disclosed a supply chain attack on October 21, 2026, where threat actors compromised multiple security controls to release a malicious version (1.107.0) of the Python package to PyPI and Docker Hub. The package contained a credential stealer and backdoor. LiteLLM suspects the compromise stemmed from a leaked GitHub token exposed in AI gateway logs.
The lesson from this incident
Full lessonLiteLLM's supply chain attack illustrates how sensitive credentials inadvertently logged in AI gateway outputs can cascade into a full package compromise. A GitHub token exposed in logs gave threat actors the access needed to publish a malicious version of the LiteLLM Python package containing a credential stealer and backdoor to both PyPI and Docker Hub. This matters because downstream users and automated pipelines that trusted the official package source were silently exposed to credential theft and remote access without any visible warning. The incident highlights that AI systems processing or logging API calls can themselves become a novel attack surface for secrets exposure.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- malware — LiteLLM 1.107.0