The attack chain behind the LiteLLM v1.107.0 release incident
LiteLLM published a root cause analysis reconstructing the full attack chain of the malicious version litellm==1.107.0. On May 27, 2026, a configuration file containing the Agent Platform master key was committed to a public repository; the key was flagged for revocation but was not revoked. On October 10, the attacker used the master key to extract the GitHub CLI OAuth token of the GitHub organization owner from the API, gaining owner-level access, and then used an internal repository's CI workflow to exfiltrate the tokens of two maintainers to webhook.site. On October 21, the attacker bypassed branch protection, pointed the release source to a fork of the impersonating organization Berri-AI, used the stolen tokens to trigger and approve a production release, and 7 malicious wheels were published to PyPI, with Docker Hub and GHCR images published afterward; the attacker also deleted run records and force-pushed to clean up history.
The original source reconstructs, time period by time period, how the attacker used a single leaked key that was never rotated to gain organization access and poison the release; teams maintaining CI/CD and secrets management can use it to check their own processes.