Security Breach at LiteLLM GitHub Repository: A Closer Look
In a recent alarming incident, LiteLLM’s GitHub organization faced a security breach when hackers accessed their systems and executed credential-stealing workflows a full eleven days prior to an October 21 supply chain attack that resulted in the distribution of malicious Python packages labeled litellm==1.107.0. This incident not only signifies a robust strategy on the attackers’ part but also underscores vulnerabilities within the organization’s security protocols.
Extended Compromise Window Prior to Attack
Research by cybersecurity firm Socket revealed that evidence of unauthorized access was detected as early as October 10 and 12, 2026, establishing a notably extended compromise window. During this time, two dubious workflows were executed within the repository named BerriAI/litellm. Both workflows bore maintenance-style commit messages, specifically labeled as ci: bump cache config, and were responsible for introducing a new file, .github/workflows/cache.yml. This file was specifically designed to collect sensitive continuous integration secrets and transfer them to endpoints that were under the attackers’ control.
Technical Execution of the Breach
The attackers employed a sophisticated method to infiltrate the repository. They created temporary branches from authentic commits, strategically pushed malicious workflows, and subsequently allowed GitHub Actions to execute before removing the branches. This maneuver made it difficult for routine repository checks to detect any anomalies or malicious activities. The branches, identified as ci-tmp-a351cc and ci-tmp-4d8517, were deleted without merging into the main codebase, further obscuring detection.
Workflow Specifics and Their Impact
The October 10 workflow was particularly notable as it targeted six different configured secrets, including critical tokens such as GH_TOKEN, GitHub App private keys, and credentials linked to LiteLLM, as well as partner organizations like Linear and Together AI. The malicious workflow executed commands that wrote these sensitive values into temporary files, specifically /tmp/c.env and /tmp/c.b64, and subsequently transmitted these files’ contents using curl to a designated URL on webhook.site. The attackers included a command || true to suppress transmission errors, allowing the action to falsely report success even if the credential exfiltration failed.
Escalation of Attacks
The variant seen on October 12 expanded the attackers’ focus from one job to six, effectively broadening their reach into multiple GitHub environments. In total, across both workflows, the attackers referenced an alarming twenty distinct secret names. These included credentials associated with well-known services such as OpenAI, Anthropic, AWS Bedrock, and various database technologies like PostgreSQL and Redis.
Evidence shows that the persistent deployment records corroborated the execution despite the deletion of branches, indicating a concerning level of access and control over the repository. LiteLLM’s internal investigation linked the initial breach back to a master key for the Agent Platform that was accidentally made publicly accessible on May 27. This key was never revoked, which paved the way for the attackers to access additional sensitive resources.
The Final Phase of the Attack
On October 21, leveraging the access acquired through the stolen keys, the attackers bypassed branch protections using privileges from the organization’s owner, modifying the release pipeline to redirect toward a mimic repository labeled Berri-AI/litellm. This devious rerouting allowed them to sign and publish seven malicious PyPI wheels, as well as compromise various container images. In response, LiteLLM took immediate action by locking their registries, limiting access to trusted organization members, and revoking credentials across internal systems while suspected vendors were also investigated.
In light of these developments, Socket’s analysis highlighted that while the earliest substantiated activity dated October 10, it did not imply it marked the initiation of the breach. The significant uncertainties surrounding the deleted branches and successful workflow statuses leave room for concern regarding the complete duration and scope of the compromise.
Indicators of Compromise (IOCs)
For security professionals, critical indicators have been established. The exfiltration endpoints used during the attack were recorded, including various HTTP request header tags tied to the workflows executed on specific dates. Additionally, the malicious workflow file .github/workflows/cache.yml is particularly noteworthy, as it served a critical function in secret exfiltration.
Conclusion
The breach at LiteLLM is a stark reminder of the vulnerabilities that can exist within software supply chains, particularly as reliance on platforms like GitHub increases. Organizations must remain vigilant and proactive in securing their environments against such sophisticated attacks, reinforcing the significance of implementing stringent security practices, auditing access permissions regularly, and ensuring sensitive keys and tokens are managed responsibly.