LiteLLM juma kuni ma'lum qilishicha, 2026-yil may oyining oxirida jamoat GitHub omboriga tasodifan e'lon qilingan Agent Platform master kaliti oxir-oqibat tahdid qiluvchiga mashhur Python paketining zararli versiyasini yuklash imkonini berdi.
"2026-yil 27-mayda LiteLLM-Labs/lite-harness jamoat omboriga konfiguratsiya fayli kiritildi, u tasodifan LiteLLM Agent Platform — agentlarni boshqarish uchun ishlatiladigan ochiq manbali vosita — joylashtirilgan master kalitni o'z ichiga oldi", — deb aytishdi LiteLLM'dan Oliver Jensen va Mateo Wang.
"Xato tezda aniqlandi, commit majburan qayta yozildi va biz ochilgan kalitlarni bekor qilish kerakligini aniqladik. Biroq master kalit uchun bekor qilish amalga oshirilmadi."
LiteLLM ma'lum qilishicha, noma'lum hujumchi ("69.48.229[.]143" manzilidan ishlagan) 2026-yil 10-oktabrda ushbu bekor qilinmagan kalitdan foydalanib Agent Platformga kirish huquqini qo'lga kiritdi va xizmat o'z-o'zini boshqaradigan bulut agentlariga GitHub omborlariga pull so'rovlarini yuborish imkonini berish uchun sozlangan GitHub CLI OAuth tokenini chiqarib oldi.
Ochiq manbali katta til modeli (LLM) shlyuzi ishlab chiquvchilari aytishicha, token "chegaralanmagan" va tashkilot egasining hisobiga bog'langan edi.
Tokenni qo'lga kiritish hujumchiga tashkilot bo'ylab barcha omborlarga egasi darajasidagi kirish huquqini berish va qo'shimcha ma'lumotlarni o'g'irlash imkonini berdi. Tahdid qiluvchi tomonidan keyingi qadamlar quyidagicha:
- 2026-yil 10-oktabr, UTC vaqti bilan 22:11 dan 22:12 gacha: Hujumchi ichki omborlarda (BerriAI/litellm va BerriAI/litellm-auto) tashlab yuborilgan shoxalarda commit qiladi va hujumchi nazoratidagi webhook[.]site nuqtasi orqali ikki muhandisning — saqlovchi huquqlariga ega — GitHub CLI OAuth tokenlarini olish uchun mo'ljallangan ish oqimlarini ishga tushiradi. Ikkala ish bir necha daqiqadan so'ng o'chiriladi.
- 2026-yil 21-oktabr, UTC vaqti bilan 10:08 dan 11:08 gacha: Shox himoyasini bekor qilish va reliz quvurni o'zgartirish, manba "BerriAI/litellm" emas, balki "Berri-AI/litellm" ko'rinishidagi omborga yo'naltiriladi.
- 2026-yil 21-oktabr, UTC vaqti bilan 11:39 dan 11:40 gacha: LiteLLM 1.107.0 versiyasi PyPI'ga e'lon qilinadi.
- 2026-yil 21-oktabr, 11:46 UTC: Docker Hub va GHCR tasvirlari e'lon qilinadi.
- 2026-yil 21-oktabr, UTC vaqti bilan 11:53 dan 11:54 gacha: Ishlab chiqarish va sinov ish yozuvlari o'chiriladi.
- 2026-yil 21-oktabr, 12:06 UTC: Upwind tadqiqotchisi Lidor Machluf ta'minot zanjiri hujumini xabar qiladi.
- 2026-yil 21-oktabr, 13:23 UTC: PyPI LiteLLM 1.107.0 versiyasini karantinga oladi.
- 2025-yil 21-oktabr, 14:20 UTC: Docker Hub'dagi v1.107.0, latest, main-latest va main-stable teglar o'chiriladi yoki tasdiqlangan toza tasvirlarga qayta yo'naltiriladi.
"Odatda, relizni qurish va e'lon qilish vakolatli muhandis tomonidan boshlanishi va ofisimizdagi jismoniy qurilmaga bog'langan maxsus hisob tomonidan tasdiqlanishi kerak", — deb aytdi LiteLLM.
"Bu cheklov joriy hafta boshida tez-tez relizlar va xatolik tuzatishlari uchun vaqtinchalik bosimni qondirish maqsadida yumshatildi, bu esa har qanday ikki muhandisga relizni boshlash va tasdiqlash imkonini berdi. Shunday qilib, tahdid qiluvchi tokenlardan birini relizni boshlash (joylashtiruvchini o'zining zararli omboriga yo'naltirgandan so'ng) va boshqasini tasdiqlash uchun ishlatdi."
Bundan tashqari, loyiha saqlovchilari ta'kidladiki, tahdid qiluvchi bu cheklovni (yoki uni butunlay olib tashlashni) o'zi ham amalga oshirishi mumkin edi, chunki ular allaqachon tashkilot egasiga tegishli tokenni qo'lga kiritgan edilar. Bu aniqlashdan qochish uchun qilinmagan deb taxmin qilinmoqda.
LiteLLM shuningdek, ish oqimlari qo'shimcha kalitlar va tokenlarni aniqlash va o'g'irlash uchun mo'ljallanganligini, ayniqsa yuqori oqimdagi xulosa API tokenlariga e'tibor qaratganini aytdi. Hodisaga javoban kompaniya har bir ichki tizim va sotuvchi platformasi bilan bog'liq har bir tokenni bekor qilish ustida ishlayotganini ma'lum qildi.
Topilmalar LiteLLMning dastlabki farazini — GitHub CLI OAuth tokenlari ichki LiteLLM joylashtirilgan loglaridan o'g'irlangan — rad etdi. "Tekshiruv biz doimiy ravishda qo'shimcha ma'lumot o'rganadigan jarayon edi, ya'ni ba'zi taxminlarimiz va ishonchlarimiz keyinchalik noto'g'ri yoki to'liq emas deb isbotlandi", — deb tan oldi Jensen.
Ish oqimlari haqida ko'proq tafsilotlar
Zararli ish oqimlari bo'yicha o'z tekshiruvini e'lon qilgan Socket, ".github/workflows/cache.yml" faylini qo'shadigan ikkita zararli commitni tiklaganini aytdi. Birinchi commit 2026-yil 10-oktabr, UTC vaqti bilan 22:11:45 da qilingan. Ikkinchisi 12-oktabrda qilingan.
"Hech bir commit hali ham mavjud bo'lgan shoxaga yuborilmagan", — deb aytdi Socket xavfsizlik tadqiqotchisi Karlo Zanki The Hacker News bilan bo'lishilgan hisobotda. "Ikkalasi ham ci-tmp- nomli qisqa muddatli shoxalarga yuborilgan, ular bir necha daqiqa ichida yaratilgan, ishlatilgan va o'chirilgan, shuning uchun bu faoliyat omborning odatiy tarixida deyarli hech narsa qoldirmaydi."
Ilova xavfsizligi firmasining ombor faoliyat jurnali yozuvlari tahliliga ko'ra, ikkala commit ham pushni zararsiz ko'rinishga keltirish uchun qonuniy commitni shoxa asosi sifatida ishlatadi:
- "ci-tmp-" nomli tashlab yuboriladigan shoxani (ya'ni ci-tmp-a351cc va ci-tmp-4d8517) ombordagi yaqinda qonuniy commitdan yaratish.
- ".github/workflows/cache.yml" faylini qo'shadigan commitni "ci: bump cache config" mavzusi bilan yuborish.
- Ish oqimi har safar commit yoki teg yuborilganda ishga tushadigan qilib sozlangan (ya'ni "[on: [push]](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#push)"), bu esa uni ishga tushiradi.
- Shoxani o'chirish.
LiteLLM ta'kidlaganidek, ikkala ish oqimi ham tashkilotning Linear ish maydoni, LiteLLM joylashtirilishi va Together AI uchun GitHub tokenlari va API kalitlarini, shuningdek GitHub App identifikatori va imzo kalitini yig'ish uchun jihozlangan.
12-oktabrdagi ish Anthropic, OpenAI, AWS Bedrock, Tavily va GitGuardian maxfiy skanerlash ijarachisi uchun API kalitlarini o'z ichiga olgan ko'proq maxfiy ma'lumotlarni yig'ishni kengaytiradi. Shuningdek, Playwright saqlash holati, PostgreSQL ma'lumotlar bazasi ma'lumotlari (ulanish satri, hisob nomi, parol), Redis nuqta manzili, port va autentifikatsiya parolini ham qo'lga kiritadi.
Ikkala ish oqimidan yig'ilgan ma'lumotlar ikkita turli webhook[.]site nuqtasiga yuboriladi:
- webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37
- webhook[.]site/4da03473-a3e7-4dc2-a087-9c564b4208e1
"GitHub tokeni va GitHub App shaxsiy kaliti — bu omborni joylashtirgan platforma uchun ma'lumotlar, uchinchi tomon xizmati uchun emas", — deb aytdi Zanki. "GITGUARDIANAPIKEY — bu maxfiy skanerlash platformasining o'zi uchun ma'lumot, bu hujumchiga ushbu faoliyatni yuzaga chiqaradigan ogohlantirishlar ustidan ko'rinish va ehtimol nazorat beradi.
E2ELINEARSTORAGESTATEB64 — bu Playwright tomonidan oxirgi foydalanuvchi testlari uchun ishlatiladigan seriyalashtirilgan brauzer sessiya holati; haqiqiy saqlash holati tegishli Linear hisobiga parol va ko'p faktorli autentifikatsiyani qondirmasdan kirish imkonini beradi."
Zararli paket versiyasi nima qiladi
Ko'plab hisobotlar LiteLLM 1.107.0 versiyasi bilan birga kelgan fayllar Python ishga tushganda avtomatik ravishda bajariladigan qilib ishlab chiqilganini, hatto ilova LiteLLMni import qilmagan bo'lsa ham, ochib berdi.
Zararli dastur ikkita bajarilish yo'liga ega: ishlab chiquvchi vositalari, AI ilovalari, bulut muhitlari va veb-brauzerlar bo'ylab autentifikatsiya materiallarini nishonga oladigan ma'lumot o'g'irlash moduli va har soatda hujumchi tomonidan taqdim etilgan ixtiyoriy kodni olish va bajarish uchun fon jarayoni sifatida ishga tushiriladigan Unix yo'naltirilgan orqa eshik.
O'g'irlovchi shuningdek tizim ma'lumotlari, SSH fayllari, Git va GitLab ma'lumotlari va tokenlari, muhit o'zgaruvchilari va npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems va Cargo bilan bog'liq tokenlarni yig'adi. Keyin ma'lumotlar siqiladi va "litellm[.]dev/healthcheck" manziliga HTTP POST so'rovi yordamida yuboriladi. Domen 2026-yil 13-oktabrda ro'yxatdan o'tgan.
"Birgalikda, bu mexanizmlar potentsial ta'sirni faol LiteLLM joylashtirilgan muhitlardan tashqariga kengaytirdi: ta'sirlangan muhitda Pythonni shunchaki ishga tushirish zararli kodni faollashtirishi mumkin edi, hatto LiteLLM o'zi hech qachon import qilinmagan bo'lsa ham", — deb aytdi Microsoft Security Research jamoasi.
"Ishga tushirish fayllari LiteLLM ilova katalogidan tashqarida joylashganligi sababli, faqat ilova fayllarini o'chirish zararli ishga tushirish komponentlarini ortda qoldirishi mumkin edi."
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.
"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of the LiteLLM Agent Platform, an open source tool we use for orchestrating agents," LiteLLM's Oliver Jensen and Mateo Wang said.
"The error was quickly identified, the commit force-pushed over, and we identified the exposed keys as requiring revocation. However, key revocation did not occur for the master key."
LiteLLM said the unknown attacker (operating from "69.48.229[.]143") used this unrevoked key on October 10, 2026, to gain access to the Agent Platform and extracted a GitHub CLI OAuth token the service was configured with to allow self-hosted cloud agents to file pull requests to GitHub repositories.
The token, per the developers of the open-source large language model (LLM) gateway, was "not scoped down" and associated with its GitHub organization owner's account.
Gaining access to the token allowed the attacker to possess owner-level access to all repositories across the organization and perform additional credential exfiltration. The sequence of actions performed by the threat actor following this step is as follows -
- October 10, 2026, between 10:11 and 10:12 p.m. UTC: Author commits into throwaway branches on internal repositories to run workflows (BerriAI/litellm and BerriAI/litellm-auto) designed to acquire GitHub CLI Oauth tokens associated with two engineers with maintainer privileges via an attacker-controlled webhook[.]site endpoint. The two runs are deleted minutes later.
- October 21, 2026, between 10:08 and 11:08 a.m. UTC: Override branch protection and alter the release pipeline with the source set to the lookalike repository "Berri-AI/litellm" rather than "BerriAI/litellm."
- October 21, 2026, between 11:39 and 11:40 a.m. UTC: LiteLLM version 1.107.0 gets published to PyPI.
- October 21, 2026, 11:46 a.m. UTC: Docker Hub and GHCR images are published.
- October 21, 2026, between 11:53 and 11:54 a.m. UTC: Production and staging run records are deleted.
- October 21, 2026, 12:06 p.m. UTC: Upwind researcher Lidor Machluf reports the supply chain attack.
- October 21, 2026, 1:23 p.m. UTC: PyPI quarantines LiteLLM version 1.107.0.
- October 21, 2025, 2:20 p.m. UTC: Docker Hub tags v1.107.0, latest, main-latest, and main-stable are removed or repointed to verified clean images.
"In typical operation, building and publishing a release requires being kicked off by an authorized engineer and being approved by a special account locked to a physical device in our office," LiteLLM said.
Leaked master key in May 2026
"This restriction was relaxed earlier this week to accommodate the temporary push for more frequent releases and bugfix backports, allowing any two engineers to trigger and approve a release. As such, the threat actor used one of the tokens to trigger the release (after having repointed the deployer to their malicious repository), and another to approve it."
In addition, the project maintainers noted that the threat actor could have very well loosened this restriction (or removed it entirely) themselves given that they were already in possession of a token belonging to an organization owner. It's suspected that this was not done to evade detection.
LiteLLM also said the workflows are designed to identify and exfiltrate additional keys and tokens, specifically focusing on upstream inference API tokens. In response to the incident, the company said it's working to revoke each and every token associated with every internal system and vendor platform.
The findings rule out LiteLLM's initial hypothesis that the GitHub CLI OAuth tokens were stolen from the logs of an internal LiteLLM deployment. "The investigation was a process in which we continually learned additional information, meaning some of our assumptions and beliefs were later proven to be inaccurate or incomplete," Jensen acknowledged.
More Details About the Workflows Emerge
Socket, which published its own investigation into the malicious workflows, said it recovered two malicious commits that each added a workflow at ".github/workflows/cache.yml." The first commit was made on October 10, 2026, at 10:11:45 p.m. UTC. It was followed by a second commit on October 12.
"Neither commit was pushed to a branch that still exists," Socket security researcher Karlo Zanki said in a report shared with The Hacker News. "Both were pushed to short-lived branches named ci-tmp- that were created, used, and deleted within minutes, which is why the activity leaves almost nothing behind in the repository's ordinary history."
According to the application security firm's analysis of the repository's activity log records, both commits rely on a legitimate commit as the branch base to make the push look seemingly harmless -
- Create a throwaway branch named "ci-tmp-" (namely, ci-tmp-a351cc and ci-tmp-4d8517) from a recent legitimate commit on the repository.
- Push a commit adding ".github/workflows/cache.yml" with the same subject, "ci: bump cache config."
- The workflow is configured to be run every time a commit or tag is pushed (i.e., "[on: [push]](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#push)"), causing it to be triggered.
- Delete the branch.
Both workflows, as highlighted by LiteLLM, are equipped to harvest GitHub tokens and API keys for the organization's Linear workspace, LiteLLM deployment, and Together AI, along with the identifier and signing key of a GitHub App.
The October 12 run extends the collection to more secrets, including API keys for Anthropic, OpenAI, AWS Bedrock, Tavily, and GitGuardian's secret-scanning tenant. It also captures Playwright storage state, PostgreSQL database information (connection string, account name, password), Redis endpoint address, port, and authentication password.
The data gathered from the two workflows is exfiltrated to two different webhook[.]site endpoints -
- webhook[.]site/65a42464-3cfa-4b02-a18c-17a6d7b86f37
- webhook[.]site/4da03473-a3e7-4dc2-a087-9c564b4208e1
"A GitHub token and a GitHub App private key are credentials for the platform hosting the repository, not for a third-party service," Zanki said. "GITGUARDIANAPIKEY is a credential for the secret-scanning platform itself, which gives an attacker visibility into, and potentially control over, the alerts that would surface this activity.
"E2ELINEARSTORAGESTATEB64 is serialized browser session state used by Playwright for end-to-end tests; a valid storage state permits authenticated access to the associated Linear account without a password and without satisfying multi-factor authentication."
What the Malicious Version of the Package Does
Multiple reports have revealed that the files bundled with LiteLLM version 1.107.0 are engineered to execute automatically when Python starts, even if an application did not import LiteLLM.
The malware features two execution paths: a credential harvesting module that targets authentication material across developer tools, AI applications, cloud environments, and web browsers, and a Unix-oriented backdoor that's launched as a background process to fetch and execute arbitrary code supplied by the attacker every one hour.
Compromised LiteLLM 1.107.0 execution flow
The stealer also collects system information, SSH files, Git and GitLab credentials and tokens, environment variables, and tokens associated with npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems, and Cargo. The data is then compressed and sent to "litellm[.]dev/healthcheck" using an HTTP POST request. The domain was registered on October 13, 2026.
"Together, these mechanisms extended potential exposure beyond active LiteLLM deployments: simply starting Python in an affected environment could activate the malicious code, even when LiteLLM itself was never imported," the Microsoft Security Research team said.
"Because the startup files resided outside the LiteLLM application directory, removing only the application files could leave the malicious startup components behind."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.