LiteLLM’s compromised release exposes the cost of an unrevoked credential
LiteLLM says an old exposed key led to an organization-owner credential and a poisoned release, despite clean source tags and signed packages.
LiteLLM’s October 23 investigation revised the explanation of its October 21 supply-chain incident.
It traces the compromise to a key exposed in May, removed from the public Git history but not revoked. An attacker used it in October to reach an experimental agent platform and obtain an organization-owner credential. [1]
The affected release was v1.107.0, including all seven PyPI wheels and specified Docker/GHCR images. LiteLLM says the GitHub source tag was clean: attackers changed the build path, and the resulting malicious artifacts were signed. Its advisory identifies affected distribution windows and says private enterprise releases were unaffected. [2]
For teams using AI gateways, the lesson is concrete: removing a leaked secret is not revocation, and a valid signature is not a complete account of how an artifact was built. Check actual installed artifacts against the incident advisory, and review whether experimental services can reach release credentials. [1][2]
Take it further
Check whether your LiteLLM installation used an affected artifact For operators who installed v1.107.0 or affected image tags. Match the actual artifact and distribution window, then follow the vendor’s current incident guidance.
Sources & details 2 sources
Discuss in your voice app
Take the reporting, visual explanations and original sources into a conversation. Copy the brief, paste it into your preferred assistant, then start its voice mode.
Paste the brief into your voice app to discuss this reporting.Reporting sources
- LiteLLM · Revised attack-chain investigation
October 23 investigation supersedes the initial root-cause explanation. Vendor account.
- LiteLLM · Affected release and distribution windows
October 21 incident advisory, subsequently updated; exact package/image scope inspected.
Images & figures
AI-generated editorial illustration. An altered ribbon enters a printing press after its inspection gear; conceptual editorial illustration of a compromised release process.
Euangelion · Source · Usage terms