What happened
LiteLLM's canonical post-mortem (published 2026-10-23, reported widely on 2026-10-24-26) identifies the initial access vector for the Oct 21 supply-chain compromise: an unrevoked Agent Platform master key leaked in a public repository in May 2026. The attacker used it to steal a GitHub org-owner CLI OAuth token on Oct 10, and over Oct 10-21 exfiltrated more maintainer tokens, overrode branch protection, and built the malicious release from a lookalike repository. This headline detail and root-cause supersedes the earlier hypothesis that tokens were stolen from internal LiteLLM response logs.
Why it matters
This is a material escalation of the previously reported v1.107.0 incident: it shows a single unrotated master key on an agent-orchestration platform gave an attacker organization-owner GitHub access, and that the malware also targeted upstream inference API keys (OpenAI, Anthropic, Bedrock) and could be loaded on any host running a LiteLLM gateway. Any organization that self-hosts the LiteLLM Agent Platform or a LiteLLM proxy with provider keys is exposed.
Attack vector
A LiteLLM Agent Platform master key was accidentally committed to the public LiteLLM-Labs/lite-harness repo on 2026-05-27 and never revoked. The attacker used it on 2026-10-10 to access the Agent Platform and extract a non-scoped-down GitHub CLI OAuth token tied to the org owner's account, then used that owner-level access over the following days to steal maintainer tokens, disable branch protection, repoint the deployer to a lookalike repo (Berri-AI/litellm), and ship the poisoned v1.107.0.
Affected systems
LiteLLM Agent Platform (open-source agent orchestration tool) and the LiteLLM release pipeline; malicious artifacts litellm==1.107.0 and Docker tags v1.107.0 / latest / main-latest / main-stable.
Mitigation
Rotate every credential that a compromised host may have reached; revoke/rotate all GitHub CLI OAuth tokens and org-owner tokens; enforce secrets rotation and least-privilege scoping; treat any host that ran litellm 1.107.0 or a pulled affected image as fully compromised; pin to a clean release such as litellm==1.106.4 and block litellm[.]dev.