LiteLLM 1.107.0 Ship Malware After Admin Key Left Active
Discover how a deleted config file left an unrevoked admin key, leading to a compromised LiteLLM 1.107.0 release on PyPI and Docker with ~49k downloads.
Stock photo for illustration only, not from the actual event
- LiteLLM 1.107.0 on PyPI and Docker shipped with credential-stealing malware
- Root cause was an admin key in a config file deleted in May but never revoked
- Attackers leveraged the leaked key to gain GitHub organization control
- Compromised version accumulated approximately 49,000 downloads in two hours
This major cybersecurity incident began on May 27, 2026, at 18:53 UTC, when a file named opencode.json was pushed to the public LiteLLM-Labs/lite-harness repository. The file contained an administrative key for an internal deployment of the LiteLLM Agent Platform. About three hours later, a follow-up commit deleted the file, but nobody followed through on revoking the administrative key.
On October 21, that forgotten key turned out to be the starting point of an attack chain that ended with a malicious litellm==1.107.0 release on PyPI and a Docker latest tag pointing to a compromised image. According to LiteLLM's postmortems and Wiz estimates, the compromised artifacts were live for about two hours.
The release contained compiled malware designed to steal credentials and load remote-code execution tools, while the official v1.107.0 source tag on GitHub never contained the malicious files. Wiz, citing ClickPy data, estimated downloads of version 1.107.0 at around 49,000 during that window.
A crucial lesson from this incident is that deleting a file containing secrets does not revoke the key. A commit that deletes a file creates a new snapshot, but the old snapshot with the key remains reachable by its hash from every clone and fork made in between. GitHub's guide stresses that revoking or rotating the secret must come first, as a revoked key in public history is harmless, whereas this unrevoked key stayed live for over four months.
Stock photo for illustration only, not from the actual event
"Secret scanning must open tickets automatically, and the ticket is only closed when revocation is confirmed"
LiteLLM
Furthermore, coding agents can make this pattern easier to miss. An agent session can add a config file in one turn and remove it in a later one, netting out the final diff so a reviewer reading only that diff never sees the key. Developers must use specialized Git log commands to search every commit and identify files deleted from the active tree.
This event highlights a critical vulnerability in modern software development pipelines reliant on automated agents and LLM tools. When high-privilege administrative keys leak, standard CI/CD pipeline controls are insufficient because an attacker wielding organization owner privileges essentially owns the pipeline itself. Implementing automated secret scanning tied to verified revocation and strict token scoping remains essential.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment