🤖 litellm==1.107.0 was published to PyPI on Oct 21 with malicious code. Root cause: an Agent Platform master key leaked in a public repo on May 27 and was never rotated. The actor extracted a GitHub org-owner OAuth token, harvested CI secrets, and hijacked the release pipeline.
🔗 https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
#CyberSec #SupplyChain #InfoSec
docs.litellm.aiThe attack chain behind the v1.107.0 LiteLLM release | liteLLMHow a master key committed to a public repository in May led to three stolen GitHub tokens and the compromised litellm v1.107.0 release, step by step.