AI Gateway LiteLLM Breached After Exposed Master Key Was Never Revoked

LiteLLM, a popular open source AI gateway, has traced last week's supply chain attack to a master key accidentally committed to a public GitHub repository on May 27. Developers spotted the mistake and removed the commit, but did not revoke the key. According to LiteLLM's postmortem, the attacker used it on October 10 to access the company's LiteLLM Agent Platform and extract a GitHub CLI OAuth token, giving owner-level access to all of its GitHub repositories.

The token was especially dangerous because GitHub CLI tokens are "post-2fa", so they do not trigger the extra authentication normally required for high-impact repository actions. The attacker added malicious commits to internal repositories, including workflows designed to steal secrets available during the development process. That let them capture tokens belonging to two engineers with maintainer privileges, plus tokens for other internal systems. LiteLLM says the attacker focused mainly on upstream inference API tokens.

The attacker then uploaded a poisoned version (1.107.0) of the package to PyPI and its container registries last Wednesday. It contained an infostealer and a remote access trojan able to run arbitrary code on infected machines. It was available for less than two hours before being quarantined, yet Wiz reports about 49,000 downloads in that time.