LiteLLM Supply Chain Attack Exposes Dangers of Leaked OAuth Tokens
Attackers leveraged leaked GitHub CLI OAuth tokens to gain unauthorized access to LiteLLM's publishing pipeline, injecting malicious code into version 1.107.0 before it was distributed via PyPI and Docker. This attack highlights how a single compromised credential in a CI/CD or development toolchain can cascade into a wide-scale supply chain compromise, affecting over 49,000 downloads. The malware functioned as both an information stealer and a Remote Access Trojan (RAT), specifically targeting cloud secrets and API keys — high-value assets in AI/LLM-driven environments. This incident underscores that open-source ecosystems are high-value targets, and that token hygiene and pipeline integrity controls are no longer optional.
Tactical Insight
Immediate actions
- Rotate all OAuth tokens, API keys, and CI/CD credentials associated with the compromised repository immediately and audit recent publish events.
- Scan all environments that installed LiteLLM version 1.107.0 for indicators of compromise, stolen credentials, and unauthorized remote access.
Long-term improvements
- Enforce short-lived, scoped tokens for all CI/CD pipelines and implement token revocation monitoring to detect leaked credentials in real time.
- Require cryptographic signing of all published packages (e.g., using Sigstore/cosign) so consumers can verify artifact integrity before installation.
- Implement a software bill of materials (SBOM) process and dependency pinning to detect unexpected changes in third-party packages before deployment.
Detection measures
- Deploy continuous monitoring on package registries and internal artifact repositories to alert on unexpected version publishes or metadata changes.
- Integrate runtime secrets scanning in cloud environments to detect exfiltration of API keys and cloud credentials as an early warning of RAT activity.