LiteLLM says leaked admin key let attacker publish malicious v1.107.0

LiteLLM has disclosed that an accidentally exposed administrator key allowed an attacker to take over its deployment system and publish a malicious version of the software. The company said the malicious release, version 1.107.0, was published to the Python package repository PyPI, to Docker Hub and to other distribution points, according to digitaltoday.co.kr.

The root of the incident dates to May 27, when a configuration file containing an agent platform master key was uploaded to a public GitHub repository. The file was deleted after the mistake was noticed, but the key itself was never revoked.

On October 10, an attacker used that key to access the agent platform and extracted GitHub access tokens tied to an unrestricted top-level administrator account. According to the account, the attacker reached every repository in the organization and stole tokens belonging to two engineers with administrative privileges.

On the 21st, the attacker redirected the deployment path to a fake repository, then used one engineer's token to start a deployment and a second token to approve it, clearing the step meant to keep a single person from shipping code alone.

Detection and cleanup warning

An Upwind researcher reported the malicious version within 30 minutes, and PyPI quarantined it about an hour later, according to the disclosure. Microsoft's security team warned that the malicious files sit outside the application folder and may remain on a system even if only the app's own files are removed.