New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
Malicious workflows ran in LiteLLM repo 11 days before supply chain attack.
Socket's Threat Research team discovered that malicious secret-exfiltration workflows were active in the LiteLLM GitHub repository on October 10, 2026, eleven days prior to the supply chain attack that deployed compromised artifacts. The attacker gained access to the GitHub organization earlier than previously known, using an accidentally committed master key to steal credentials and approve the malicious release.
AI summary of the linked source. Not reviewed by an editor. How this works
Run BerriAI?
Get an email when a new story names BerriAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn attacker gained access to the LiteLLM GitHub organization by exploiting a master key that was accidentally committed to the repository, using it to steal credentials and plant secret-exfiltration workflows eleven days before the supply chain attack was detected. This extended dwell time demonstrates a critical failure in monitoring repository activity and detecting anomalous workflow behavior. The compromised access allowed the attacker to approve a malicious release, poisoning downstream users of the package. This incident highlights how a single secrets management mistake can cascade into a full supply chain compromise affecting all consumers of a widely-used library.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — litellm==1.107.0