The newly documented lead-up
LiteLLM reports that an attacker reached its experimental Agent Platform on October 10 and extracted a GitHub CLI OAuth token associated with an organization owner. With that authority, a throwaway workflow in the main repository posted CI secrets to an attacker-controlled endpoint. Socket separately recovered evidence that the secret-stealing workflow ran on October 10, eleven days before the poisoned release.
The maintainer says the audit-log hash of the stolen GH_TOKEN matches the token used for approval at the later production release gate. This is stronger linkage than the earlier public timeline alone could establish. The revised account attributes that link to LiteLLM’s investigation rather than treating all preceding activity as independently observed by Socket.
From repository authority to release artifact
LiteLLM says the attacker changed the release workflow to take source from a fork. The same investigation reports that a compromised litellm==1.107.0 was published to PyPI and container registries on October 21. Microsoft’s artifact analysis describes files that Python can execute during normal interpreter initialization, so the execution boundary is wider than an explicit LiteLLM import.
The build and approval steps explain how expected distribution channels could carry attacker-controlled content. They do not prove that every downstream environment installed the artifact, executed the startup files or lost credentials. Each deployment needs its own artifact and execution check.
How to use this correction
The previous edition covered the poisoned release and credential risk. This revision adds the earlier credential-theft sequence and the maintainer’s evidence connecting it to release approval. It does not describe a separate LiteLLM incident or alter the original publication record.
Investigate affected artifacts and CI authority together. Identify package versions and image digests in use, preserve workflow and host evidence, then rotate exposed credentials from a trusted environment. Current maintainer and government guidance should control the detailed response for each deployment.
Evidence and review
Incident date: Unknown. Evidence checked .
Merged by pankajmouriya · Editorial merge