Emerging ThreatsSupply Chain Attacks

LiteLLM Exposes GitHub Token Leak Behind Malicious Package Release

Analyst 207||Source: TheHackerNews
Software development workstation with laptop, notes, and equipment on a neutral background.

"After a thorough investigation, we have observed specific situations in which Claude Code will embed a user's GitHub CLI OAuth token into a response body, and in situations where response bodies are logged, these tokens may appear in LiteLLM logs," LiteLLM said.

Timeline and scope of the compromise

On October 21, 2026, LiteLLM's release pipeline was compromised and a malicious build — LiteLLM v1.107.0 — was pushed to multiple registries and repositories. The incident occurred around 4:00 a.m. PST, and the poisoned artifacts included:

  • LiteLLM v1.107.0 on PyPI
  • v1.107.0, latest, main-latest, and main-stable on Docker Hub
  • v1.107.0, latest, main-latest, and main-stable on GHCR

Users who installed an unpinned version via pip between 11:39 a.m. and 1:23 p.m. UTC, or who pulled any of the affected Docker images between 11:46 a.m. and 2:20 p.m. UTC, are considered impacted.

How the malicious code operated (.pth and sitecustomize.py)

The compromised Python package contained multiple persistence and exfiltration mechanisms. A .pth path file directed the interpreter to import a module named "cook," which ran a deobfuscating script (cook.py) that executed a stealer routine called "privcollect." That routine collected system, browser, developer, cloud, and AI tool secrets and exfiltrated them via HTTP POST to litellm[.]dev/healthcheck.

On Linux and macOS hosts the installer also attempted to run sitecustomize.py. That script fetched domain.txt from a GitHub repository at github[.]com/letters9813; if the file returned a valid response the malware downloaded a second-stage payload from <domain>/codepy and executed it. Aikido researcher Ilyas Makari described the behavior: "It forks a background daemon that acquires a lock at '/tmp/remote_code_loader.lock' to prevent multiple instances, then enters an infinite loop. Every hour, the daemon fetches the attacker's current C2 domain from a GitHub repository (raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt), then fetches and executes a Python payload from https://{{domain}}/codepy."

Wiz, the Google-owned cloud security subsidiary, said the GitHub-hosted text file contained only initial test values before GitHub removed the repository around 1:30 p.m. UTC.

Supply-chain exploitation: GitHub tokens, workflow abuse, and a lookalike repo

LiteLLM says the attacker bypassed multiple controls after maintainers temporarily expanded release permissions for two engineers on October 19, 2026, to publish daily backports. The adversary used three sets of developer GitHub CLI credentials — including one that could run GitHub workflows — to push the malicious release.

The attack sequence reported by LiteLLM included use of an owner-level token to disable branch protections and force-push malicious changes, and execution of a compromised workflow that pointed at a lookalike repository ("Berri-AI/litellm" instead of "BerriAI/litellm"), causing the poisoned artifacts to be signed and published.

LiteLLM identified an "unexpected, innocuously named user account" in an internal LiteLLM deployment exposed to the public internet. The maintainers suspect the attacker accessed that deployment, extracted GitHub CLI OAuth tokens from logs, and used them to compromise the release workflow. LiteLLM also noted the tokens may have appeared in logs because "Claude Code will embed a user's GitHub CLI OAuth token into a response body."

LiteLLM said it had previously hardened its pipeline after a March incident — moving releases to a private repo, making Docker tags immutable, and signing images — but those mitigations were temporarily relaxed for backport operations.

Observed credential abuse and AWS API calls

Wiz reported observable abuse beginning roughly 4.5 hours after exfiltration. Between 4:20 p.m. and 5:01 p.m. UTC attackers validated AWS instance role credentials captured from CI runners and Kubernetes nodes from IP addresses 168.100.8[.]57 and 165.227.201[.]8.

Each credential was checked with sts:GetCallerIdentity and followed by bedrock:ListFoundationModels and a ListModels call, a pattern Wiz described as "consistent with LLMjacking." In some environments the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and performed general discovery (ListAccounts, DescribeTrails, etc.).

How developers, release engineers, and cloud operators should respond

LiteLLM and outside researchers provided concrete, action-oriented steps. Developers are advised to remove LiteLLM 1.107.0 from hosts, isolate any machines where the malicious version ran, and hunt for the malicious Python artifacts. Teams should block access to the exfiltration domain, rotate all credentials, and investigate any execution of "/codepy" on affected systems. JFrog security researcher Guy Korolevski warned: "A single compromised install can hand an attacker the ability to push malicious code downstream ... rotate every reachable credential and rebuild."

Attribution context and near-term uncertainties

Observers noted technical echoes of a March 2026 attack that used .pth files, but linkage remains unproven. Socket told The Hacker News there is "no evidence at this stage to link the two incidents," citing differences in embedded RSA keys, exfiltration implementations, and backdoor behavior. Socket added that a common operator using different tooling cannot be ruled out, but current public evidence "doesn't establish a connection to the March attack."

The incident ties a handful of concrete operational failures — exposed internal deployment, logged OAuth tokens, expanded release permissions, and a lookalike repository — into a single supply-chain compromise that rapidly transformed a trusted package into a remote access trojan with live cloud-credential abuse. Whether the stolen credentials lead to broader, long-running intrusions depends now on how quickly affected teams isolate, rotate, and rebuild.

Original reporting: https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html

Emerging ThreatsPypiSupply ChainLitellmSoftware CompromiseDocker HubGithub Token LeakGHCROauth Token LeakMalicious Package Release
Related Intelligence

Continue Reading

Server room with rows of racks and cables, one with a highlighted vulnerable system.

Threat Actors Exploit PHP2Shell Vulnerabilities Before Public Disclosure

Threat actors made a move to exploit PHP2Shell vulnerabilities just four days before they were publicly disclosed, with a suspicious probe detected by Amazon's Threat Intelligence team on October 17, 2026, originating from an anonymized IP address in Australia. This early attempt suggests that malicious actors had somehow gotten wind of the vulnerability before its scheduled reveal.

Analyst 207
Law enforcement officers from various countries gather around a table with laptops and notes in a briefing room with a…

Interpol Disrupts 11,000 African Cybercrime Networks

Thanks to Interpol's Operation Serengeti III, a massive blow has been dealt to African cybercrime networks, with 11,000 networks disrupted and a huge dent put in the operations of scammers, ransomware attackers, and business email compromise crooks. This game-changing effort was made possible by a collaboration between 21 countries and tech partners like Team Cymru, Kaspersky, and Fortinet.

Analyst 207
Industrial control system sits on a table amidst stacked crates in a brightly-lit warehouse or shipping yard.

Microsoft Warns of China-Linked Hackers Using AI in Supply Chain Attacks

Microsoft warns that China-linked hackers are leveraging AI to supercharge supply chain attacks, allowing them to swiftly exploit compromised apps and gain access to target environments. This alarming tactic was recently used to breach the ConnectWise Cloud Backup application.

Analyst 207
Cluttered server room with cables, equipment, and a laptop showing a blurred interface.

Threat Actor Wields AI in Multiform Cybercrime Spree

Meet BUGSTER, a cunning threat actor who's taking cybercrime to the next level with AI - and getting away with it all from a single US server. This tech-savvy crook is using AI-powered tools to pull off a wide range of crimes, from credential theft and data exfiltration to VoIP fraud and cryptocurrency reconnaissance.

Analyst 207