New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

Summary

Socket's Threat Research team found two malicious commits adding a .github/workflows/cache.yml workflow to the BerriAI/litellm repository, on October 10 and October 12, 2026, both pushed to short-lived branches and deleted. The workflows ran successfully, placing malicious secret-collection activity at least eleven days before the October 21 release-pipeline attack that published malicious litellm==1.107.0 artifacts. LiteLLM traced initial access to an Agent Platform master key committed to a public repository in May and never revoked.

Topics

• Model and package supply chain

Related items

• InfoOpenAI now trains its frontier AI models with no internet accessSame vendor · The Verge (AI)
• InfoIntroducing Kimi K3.1 ProSame vendor · Simon Willison's Weblog
• InfoRapidly scaling online storage to serve over 1 billion ChatGPT users (Part II)Same vendor · OpenAI Blog
• MediumInfostealer riding the AI TrainSame vendor · Check Point Research
• HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSame vendor · NVD/CVE Database