Supply chain securityLiteLLM

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLM confirmed that malicious code had been added to version 1.107.0 packages and some container images. Its investigation found that previously exposed keys that had not been revoked gave attackers publishing access. Environments that used affected versions should assess rebuilding and rotating secrets.

Anti-Ransomware · Compiled with SI agent assistanceOriginal advisory and subsequent updates:Checked 2026.10.26
Original synthetic illustration of a software package conveyor and a master key stored separately
Illustration · Source ↗ · About this image ↗

Source Facts

LiteLLM says the PyPI 1.107.0 package released on 21 October and the Docker Hub and GHCR images identified by time range and hash in its advisory were compromised. The files have been removed. The company says its private enterprise package repository was not affected by this incident.

The formal investigation published on 23 October found that an attacker used a previously exposed, unrevoked Agent Platform master key to obtain an overprivileged GitHub token and interfere with the release process. This supersedes the early hypothesis that the token leaked through LiteLLM logs.

The vendor recommends treating environments that ran affected versions as incidents, rebuilding from known-clean sources and rotating keys and credentials accessible to the host. Removing packages from distribution does not automatically clean up earlier installations.

Next Steps for Businesses / Editorial Observations

Deleting a file containing secrets or rewriting a commit does not invalidate an exposed key. Revocation and permission reduction must both be completed.

Next steps you can take

  • Check package versions, image hashes and acquisition times against the vendor's list, and isolate potentially affected environments.
  • Rebuild systems and rotate secrets in a clean environment, and review least privilege for release accounts and agents.

Original sources

Reporting leads · The Hacker News · 3 reports consolidated

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

The attack chain behind the v1.107.0 LiteLLM release

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Illustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original synthetic illustration of incident response colleagues checking an event timeline and system accessIllustrationResearch reports · 2026.10.23

SOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process

SOCRadar Threat Research UnitOriginal synthetic illustration of design studio colleagues checking shared files and maintenance arrangementsIllustrationVulnerability advisories · 2026.10.23

CISA adds an exploited vulnerability: update or remove Nextcloud's bundled CODE App

CISA / Collabora Online