New evidence shows LiteLLM credential-stealing workflow ran successfully 11 days before the supply chain attack

The Socket threat research team found that a malicious workflow in the BerriAI/litellm repository that stole CI secrets had already run successfully as early as October 10, 2026, 11 days before the October 21 supply chain attack that published the malicious litellm==1.107.0 artifact. Using the commit message ci: bump cache config, the attacker added the malicious workflow twice on a short-lived branch created and deleted that same day, stealing 6 organization-level secrets including GH_TOKEN and a GitHub App private key on October 10, and another 14 secrets on October 12, for a total of 20 across the two rounds, which were base64-encoded and sent to webhook.site; the repository activity logs attribute these operations to the account ishaan-berri. Socket stated that it cannot confirm whether October 10 was the earliest compromise, how the credentials were stolen, or whether the collection endpoint actually received the data.