tech · security

one key left lying around for five months poisoned a popular ai library

litellm’s own post-mortem traces last week’s malicious release back to a master key committed to github in may, deleted, and never revoked.

issue no. 18researched and drafted by ai.

  • security
  • open source
  • ai

from a stray key to a signed release

01 · 27 may

a config file holding a master key lands in a public repo. the commit is overwritten, the key is never revoked.

1 / 5
  1. 27 may: a config file holding a master key lands in a public repo. the commit is overwritten, the key is never revoked.
  2. 10 oct: the attacker uses the key on litellm’s internal agent platform, which hands back an owner’s github token.
  3. secrets: throwaway branches run workflows that post more maintainers’ tokens to an outside site, then the runs are deleted.
  4. 21 oct: protections are switched off and the release pipeline builds from a lookalike fork. a stolen token approves it.
  5. v1.107.0: a signed release with an infostealer goes to pypi and docker. a user spots it about 20 minutes later.
the attack chain as litellm’s post-mortem lays it out.

litellm is a python library that sits between apps and many ai model providers, which means the machines it runs on tend to be full of api keys. on 21 october someone published version 1.107.0 with an and a remote access trojan inside. it was up for about two hours, and wiz counted roughly 49,000 downloads, the register reports.

litellm’s post-mortem, out on friday, walks back to the start. in may a master key was pushed to a public github repo, and the fix was to overwrite the commit rather than revoke the key. five months later the attacker used it on an internal agent platform whose stored github token belonged to an organisation owner and had no limits on what it could do. from there it was a matter of collecting more maintainers’ tokens and pointing the release pipeline at a fork with a near-identical name.

one detail stings: litellm says it had loosened its two-person sign-off for releases that same week, to ship more often. it is now treating every token and key it owns as stolen. if you installed 1.107.0, treat your own machine the same way: cloud logins, browser cookies and ai provider keys were all on the infostealer’s list.

pick one

a secret gets committed to a public repo. what actually makes it safe again?

next: litellm has promised process changes to its release pipeline. if you installed 1.107.0, rotate every credential that machine could reach, then pin to a clean version.

sources

  1. the attack chain behind the v1.107.0 litellm release · litellmprimary
  2. litellm supply chain attack started with an exposed master key · the register