LiteLLM 1.107.0: an unrevoked agent key escalates into a release hijack

On October 21, 2026, attackers published the malicious litellm==1.107.0 to PyPI and pointed the official LiteLLM Docker Hub and GHCR tags to a poisoned image; the malicious wheel remained on PyPI until 13:23 UTC. According to LiteLLM's October 23 attack chain disclosure, the root cause was that the master key of an agent platform experimental deployment on May 27 was committed to a public repository; the team overwrote the commit but did not revoke the key, and four and a half months later the attackers used that key to call the agent platform API, exchanging it for an unscoped-permission CLI OAuth token belonging to a GitHub organization owner, then collected maintainer tokens, overwrote branch protection and hijacked the release pipeline. Microsoft and StepSecurity found that the payload runs on every Python startup, collects credentials for cloud, developer, AI tools, browsers and the LiteLLM proxy database, and on Unix hosts also starts a detached daemon that polls remote code hourly.