The incident manifested last Wednesday when a poisoned version, 1.107.0, of the open source AI gateway was uploaded to PyPI and its container registries. This compromised release contained both an infostealer and a remote access trojan capable of executing arbitrary code on affected machines.
According to Wiz, the trojanized package garnered approximately 49,000 downloads before being quarantined on PyPI, despite being available for less than two hours.
LiteLLM detailed the attack progression on Friday, tracing it back to May 27. On that date, a configuration file containing the master key was committed to the public LiteLLM-Labs/lite-harness repository. This key controlled an internal tool used by LiteLLM to orchestrate AI agents.
Although the project developers promptly identified and removed the exposed commit, the master key was not revoked. The Friday postmortem noted, “On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token.”
This token provided the threat actor with owner-level access across all of LiteLLM’s GitHub repositories. This access was particularly significant because GitHub CLI tokens are “post-2fa,” meaning they bypass standard high-impact authentication flows.
The token enabled the attacker to create malicious commits in various internal repositories, including workflows designed to steal tokens and secrets available during the continuous integration development process. Furthermore, they obtained tokens belonging to two engineers with maintainer privileges and credentials for several other internal systems.
LiteLLM reported, “Reviewing the actor's activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens.” Because the compromised identities appeared legitimate, the malicious changes could be made without triggering suspicion.
The infostealers within the package were designed to harvest sensitive data, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, alongside AWS credentials, Google Cloud Platform service account keys, Microsoft Azure tokens, and API keys for OpenAI, Anthropic, Cohere, and other LLM providers.
This development underscores the critical operational vulnerability inherent in key management practices, as the developers stated, “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key.”
This event highlights the inherent risks within the software supply chain, where a single compromised credential can grant deep, persistent access across development, deployment, and operational platforms utilized by market participants.
