New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

Socket discovered a supply chain attack targeting the BerriAI/litellm GitHub repository, where malicious GitHub Actions workflows were deployed 11 days before a malicious package was published to PyPI and Docker. The attacker used short-lived branches to inject a secret-exfiltration workflow at .github/workflows/cache.yml, which successfully ran on October 10 and October 12, 2026, stealing CI/CD secrets including GitHub tokens, API keys, and environment credentials. The stolen credentials, particularly a GitHub token and GitHub App private key, likely enabled the later compromise of the release pipeline used to distribute the malicious litellm==1.107.0 package on October 21, 2026.

AI-extracted · verify before operational use