LiteLLM investigation traces GitHub intrusion to October 10

Attackers infiltrated LiteLLM’s GitHub organisation eleven days before distributing malware through its software releases, with newly recovered records showing credential-stealing workflows operating on October 10 and 12.

Security company Socket identified two malicious workflow commits in the BerriAI/litellm repository, while LiteLLM’s investigation confirmed that stolen credentials from the earlier intrusion helped attackers manipulate its October 21 release process. The findings establish a longer period of unauthorised access than the poisoned package publication initially indicated.

LiteLLM disclosed on October 23 that the intrusion originated with a master key inadvertently published in a public GitHub repository on May 27. Although the exposed configuration was removed, the key was not revoked. Attackers subsequently used it to access an internal Agent Platform service and retrieve a GitHub organisation owner’s authentication token on October 10.

That token provided owner-level access across the organisation’s repositories. The intruders used it to create temporary branches and execute GitHub Actions workflows designed to transmit confidential credentials to an external collection service. LiteLLM confirmed that the operation obtained additional authentication tokens belonging to two maintainers.

Socket recovered a workflow committed at 22:11 UTC on October 10 and another deployed on October 12. Both introduced a file named cache. yml under GitHub’s workflow directory, using the innocuous commit description ci: bump cache config. The branches were deleted after execution, leaving the malicious instructions absent from the repository’s main branch.

GitHub Actions performance records showed successful executions on both dates. Socket cautioned that a successful workflow status alone could not establish whether every attempted transmission reached its destination, because the malicious scripts suppressed errors. LiteLLM’s separate audit investigation nevertheless confirmed the theft of maintainer credentials and connected one stolen token to approval of the compromised release.

The first workflow targeted six secrets, including a GitHub authentication token, a GitHub application private key, and credentials associated with LiteLLM, Linear and Together AI. It encoded the collected information and attempted to send it to a webhook. site endpoint.

The October 12 workflow expanded the operation to six jobs, five associated with specific testing environments. It targeted fourteen additional secret names, including OpenAI and Anthropic API keys, database credentials, Redis authentication details and a token associated with the GitGuardian security platform. Socket said the two operations targeted distinct sets of secrets rather than repeating the same collection.

The attacker subsequently exploited the stolen identities to alter LiteLLM’s private release workflow. An initial attempt to push an unauthorised change was blocked by branch protection on October 21, but the organisation owner’s token enabled the intruder to override that restriction.

The modified process directed the official release machinery towards a lookalike GitHub organisation, Berri-AI, instead of the legitimate BerriAI source. Another compromised maintainer credential approved production deployment. This allowed malicious software to be built, signed and distributed through trusted publication channels.

Seven compromised Python package files for litellm version 1.107.0 appeared on the Python Package Index between 11:39 and 11:40 UTC on October 21. Affected Docker images were also published. LiteLLM removed the Python packages by 13:23 UTC and cleared or redirected the affected Docker Hub tags by 14:20 UTC.

Microsoft’s security researchers established that the malicious package used Python startup mechanisms capable of executing credential theft without an application explicitly importing LiteLLM. The payload targeted authentication material across cloud services, developer tools, browsers and artificial intelligence applications, while also providing infrastructure for remote code execution.

LiteLLM advised organisations that installed the affected version to treat their environments as compromised, rebuild installations and rotate accessible credentials. It said earlier package versions and private enterprise releases were unaffected. The company also revoked credentials, restricted GitHub organisation membership and suspended publication arrangements during containment.

The company said the attacker also deleted staging and production workflow records after publishing the malicious release, limiting the evidence available to investigators. Its October 23 account superseded preliminary explanations that had suggested the tokens were exposed through logs from an internal LiteLLM deployment. The later reconstruction instead identified the Agent Platform service as the initial route into the organisation. LiteLLM said it was revoking credentials across internal systems and external vendors as a precaution.

Socket’s reconstruction relied partly on repository activity records and deployment histories that survived deletion of the temporary branches. One October 12 deployment remained visible under the integration-redis environment, carrying the malicious commit description and the deleted branch identifier ci-tmp-4d8517.