Xakerlar LiteLLM GitHub Repozitoriyasini Ta'minot Zanjiri Hujumidan 11 Kun Oldin Buzib Kirishdi

Xakerlar LiteLLM’ning GitHub tashkilotiga kirib, 21-oktabr ta'minot zanjiri hujumidan 11 kun oldin — ya'ni 10-oktabr va 12-oktabr 2026-yilda — maxfiy ma'lumotlarni o'g'irlovchi ish oqimlarini ishga tushirishdi. Bu hujum natijasida zararli litellm==1.107.0 paketlari tarqatilgan edi.

Topilmalar shuni ko'rsatadiki, zaharlangan relizlardan oldin buzilish davri ancha uzoqroq bo'lgan. Socket BerriAI/litellm repozitoriyasida 10-oktabr va 12-oktabr 2026-yilda bajarilgan zararli ish oqimlarini aniqladi.

Har ikkala ish oqimi ci: bump cache config degan texnik xizmat uslubidagi commit xabaridan foydalangan va .github/workflows/cache.yml faylini joriy etgan. Bu fayl CI (doimiy integratsiya) maxfiy ma'lumotlarini yig'ib, ularni hujumchiga tegishli manzillarga yuborish uchun mo'ljallangan edi.

Hujumchi haqiqiy commitlardan vaqtinchalik tarmoqlar yaratgan, zararli ish oqimini push qilgan, GitHub Actions uni bajarishiga ruxsat bergan va keyin tarmoqlarni o'chirib tashlagan.

ci-tmp-a351cc va ci-tmp-4d8517 deb nomlangan bu tarmoqlar main tarmog'iga birlashtirilmasdan yo'qolgan, bu esa odatiy repozitoriya tekshiruvlari paytida ko'rinishni cheklagan.

Ishlash Ko'rsatkichlari (Manba: Socket)

10-oktabrdagi ish oqimi oltita sozlangan maxfiy ma'lumotni, jumladan GH_TOKEN, GitHub App shaxsiy kaliti va LiteLLM, Linear hamda Together AI bilan bog'liq ma'lumotlarni nishonga olgan bitta ishni o'z ichiga olgan.

U qiymatlarni /tmp/c.env fayliga yozgan, faylni /tmp/c.b64 ga kodlagan va curl yordamida natijani webhook.site ga POST qilgan. Oxiridagi || true uzatish xatolarini bostirgan.

Natijada, ish hatto uzatish muvaffaqiyatsiz bo'lsa ham muvaffaqiyatli deb hisobot berishi mumkin edi. GitHub Actions ishlash ko'rsatkichlari bitta muvaffaqiyatli bajarilishni — taxminan to'rt soniya davom etganini — qayd etgan, ammo bu ko'rsatkichlar yig'uvchining ma'lumotlarni qabul qilganini aniqlay olmagan.

12-oktabr varianti yig'ishni oltita ishga kengaytirgan, ulardan beshtasi sozlangan GitHub muhitlari bilan bog'langan. Ikkala ish oqimi bo'yicha hujumchilar 20 ta turli maxfiy ma'lumot nomini, jumladan OpenAI, Anthropic, AWS Bedrock, GitGuardian, PostgreSQL, Redis va Linear brauzer sessiya materiallarini eslatib o'tgan.

Joylashtirish Yozuvlari (Manba: Socket)

Doimiy muhit joylashtirish yozuvlari tarmoqlar o'chirilgandan keyin ham bajarilishni tasdiqlagan. LiteLLM tekshiruvi dastlabki kirishni 27-mayda tasodifan ommaviy e'lon qilingan va hech qachon bekor qilinmagan Agent Platform asosiy kalitiga bog'lagan.

10-oktabrda hujumchi bu kalitdan foydalanib, tashkilot egasiga tegishli cheklovsiz GitHub CLI OAuth tokenini olgan. Bu kirish qo'shimcha ma'lumot o'g'irlanishiga imkon bergan. LiteLLM audit-jurnal token xeshlarini BerriAI/litellm dan o'g'irlangan GH_TOKEN ni zararli ishlab chiqarish relizini tasdiqlash bilan bog'laganini aytgan.

Yana bir o'g'irlangan maintainer tokeni reliz ish oqimi yozuvlarini o'chirish uchun ishlatilgan. 21-oktabrda hujumchi egasi huquqlaridan foydalanib tarmoq himoyalarini chetlab o'tgan va reliz quvurini Berri-AI/litellm deb nomlangan o'xshash repozitoriyaga yo'naltirgan.

Quvur keyinchalik yettita zararli PyPI g'ildiraklarini va buzilgan konteyner tasvirlarini imzolab, nashr etgan. LiteLLM registrlarni qulflab, GitHub tashkilotidagi bitta ishonchli a'zodan tashqari barchani olib tashlagan va ichki tizimlar hamda sotuvchilar bo'yicha ma'lumotlarni bekor qilishni boshlagan.

Socket 10-oktabrni u tasdiqlay olgan eng erta faoliyat deb ogohlantirgan, bu buzilishning boshlanishi emas. Shuning uchun o'chirilgan tarmoqlar va muvaffaqiyatli ish oqimi holatlari buzilishning to'liq davomiyligi va ko'lami haqida muhim noaniqlik qoldiradi.

IOC (Ko'rsatkichlar)

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defanged (masalan, [.]) qilingan. Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedkasi platformalarida qayta fang qiling.

ANY.RUN yordamida tahdid tekshiruvlarini soddalashtiradigan va qo'lda mehnatni kamaytiradigan 16 000+ SOC jamoalariga qo'shiling. Jamoangiz uchun o'rganing

Hackers accessed LiteLLM’s GitHub organization and executed credential-stealing workflows eleven days before the October 21supply chain attack that distributed malicious litellm==1.107.0 packages.

The findings establish a longer compromise window preceding the poisoned releases. Socket recovered malicious workflows executed inside BerriAI/litellm on October 10 and October 12, 2026.

Both used the maintenance-style commit message ci: bump cache config while introducing .github/workflows/cache.yml, a file designed to collect continuous integration secrets and transmit them to attacker-controlled endpoints.

The attacker created temporary branches from legitimate commits, pushed the malicious workflow, allowed GitHub Actions to execute, and deleted the branches.

Named ci-tmp-a351cc and ci-tmp-4d8517, these branches disappeared without merging the workflow into main, limiting visibility during routine repository reviews.

Performance Metrics (Source: Socket)

The October 10 workflow contained one job targeting six configured secrets, including GH_TOKEN, a GitHub App private key, and credentials associated with LiteLLM, Linear, and Together AI.

It wrote the values into /tmp/c.env, encoded the file into /tmp/c.b64, and used curl to POST the resulting content to webhook.site. A trailing || true suppressed transmission errors.

As a result, the job could report success even when exfiltration failed. GitHub Actions performance metrics recorded one successful execution lasting approximately four seconds, but those metrics alone could not establish whether the collector received the credentials.

The October 12 variant expanded collection to six jobs, five bound to configured GitHub environments. Across both workflows, attackers referenced 20 distinct secret names covering OpenAI, Anthropic, AWS Bedrock, GitGuardian, PostgreSQL, Redis, and Linear browser session material.

Deployment Records (Source: Socket)\

Persistent environment deployment records corroborated execution after the branches were deleted. LiteLLM’s investigation traced initial access to an Agent Platform master key accidentally committed publicly on May 27 and never revoked.

On October 10, the attacker used that key to retrieve an unrestricted GitHub CLI OAuth token belonging to an organization owner. The resulting access enabled additional credential theft. LiteLLM said audit-log token hashes connected the GH_TOKEN stolen from BerriAI/litellm to approval of the malicious production release.

Another stolen maintainer token was used to delete release workflow records. On October 21, the attacker bypassed branch protections using owner privileges and redirected the release pipeline toward the lookalike Berri-AI/litellm repository.

The pipeline subsequently signed and published seven malicious PyPI wheels and compromised container images. LiteLLM locked registries, removed all but one trusted GitHub organization member, and began revoking credentials across internal systems and vendors.

Socket cautioned that October 10 represents the earliest activity it could substantiate, not necessarily the intrusion’s beginning. Deleted branches and successful workflow statuses therefore leave important uncertainty about the compromise’s complete duration and scope.

IOCs

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.Explore for your team