LiteLLM hit again: protect your release pipeline
A malicious LiteLLM release was live for about two hours, published through the project’s own workflow with stolen engineer tokens.
For the second time this year, LiteLLM shipped a malicious release. Version 1.107.0 appeared on PyPI and in the official Docker images on 21 October and was removed after about two hours. It installed a credential stealer that runs every time Python starts, plus a loader that fetches more code every hour.
This time the attackers didn’t steal a publishing token. According to LiteLLM, they used stolen GitHub CLI OAuth tokens from three engineers to trigger the project’s own private release workflow.
- If 1.107.0 was installed anywhere, rebuild that machine or container and rotate every secret it could reach.
- Pin versions with hashes. A two-hour window only hurts those who auto-upgrade.
- For your own projects: require a second person to approve release workflows, and keep long-lived OAuth tokens off developer machines.
- Review which accounts can trigger releases. It’s often more people than needed.