Executive Summary
In October 2026, the popular open-source AI gateway LiteLLM suffered a significant supply chain compromise originating from a master key accidentally committed to a public repository in May 2026. Although the commit was force-pushed, the key was not revoked, allowing an attacker operating from 69.48.229[.]143 to gain owner-level access to LiteLLM's GitHub organization. This access was used to exfiltrate engineer credentials and modify the release pipeline.
The attacker successfully published a malicious version of LiteLLM (v1.107.0) to PyPI and Docker Hub. This version contained a credential stealer and a persistent backdoor that activated whenever Python was started in the environment, regardless of whether LiteLLM was imported. The incident highlights the critical risk of unrevoked secrets and the dangers of relaxed branch protection rules during rapid development cycles.
While the malicious version was quarantined within hours of being reported, the incident's impact is severe as the malware targeted a wide range of developer tools, cloud environments, and AI API tokens (OpenAI, Anthropic, AWS Bedrock). Organizations using LiteLLM should audit their environments for version 1.107.0 and assume all secrets stored in affected environments are compromised.