LiteLLM, an open-source tool widely used by artificial intelligence developers, has disclosed that an application programming interface key accidentally exposed in May was behind a supply-chain attack believed to have affected tens of thousands of users in late October. The disclosure was reported on 26 October by The Record.

A routine secret leak with an unroutine ending

According to the account, a configuration file containing a master key for LiteLLM's internal Agent Platform was committed to a public repository, LiteLLM-Labs/lite-harness, on 27 May 2026. The commit was later overwritten, and other keys found in it were treated as needing revocation. The master key, however, was not revoked.

From key to malicious package

On 10 October, an attacker is reported to have used that still-valid key to access the Agent Platform and obtain a GitHub command-line OAuth token belonging to an organisation owner. That access then helped the attacker push changes that led to a malicious release, LiteLLM version 1.107.0, published on 21 October. Extra files in that release could run when Python started, meaning affected hosts did not need to import LiteLLM for the payload to execute.

What LiteLLM users should check

Check whether version 1.107.0 was installed from the affected window, including container images, and remove any suspect installs. Rotate GitHub tokens, API keys and any other credentials that could have been exposed through that environment, review repository and workflow activity around 10–12 October, and rebuild from a clean, trusted release. Do not simply reinstall over a suspect environment and assume it is clean. The lesson is deliberately ordinary, and therefore worrying for other teams: deleting or overwriting a leaked commit is not the same as revoking the secret.

Source: The Record