LiteLLM has established how its release pipeline was poisoned on 21 October, when a malicious v1.107.0 build was published to PyPI and Docker. The company says the attacker operated through the GitHub accounts of three of its engineers using stolen GitHub CLI OAuth tokens: one account changed the release pipeline and triggered the release, a second approved it, and a third deleted the workflow records, limiting the logs available to investigators. The tokens were taken from the logs of an internal LiteLLM deployment that was exposed to the public internet. The vendor has also published exposure windows — the bad package sat on PyPI from 11:39 to 13:23 UTC and Docker tags v1.107.0, latest, main-latest and main-stable served it from 11:46 to 14:20 UTC — with v1.106.2 the last safe release. LiteLLM notes it has observed Claude Code embed a user's GitHub CLI OAuth token in a response body, so tokens can surface wherever gateway logs retain response bodies.

• Source article