Litellm Investigation Traces Github Intrusion To October 10 Arabian Post

(MENAFN- The Arabian Post) clearfix"> Attackers infiltrated LiteLLM's GitHub organisation eleven days before distributing malware through its software releases, with newly recovered records showing credential-stealing workflows operating on October 10 and 12.

Security company Socket identified two malicious workflow commits in the BerriAI/litellm repository, while LiteLLM's investigation confirmed that stolen credentials from the earlier intrusion helped attackers manipulate its October 21 release process. The findings establish a longer period of unauthorised access than the poisoned package publication initially indicated.

LiteLLM disclosed on October 23 that the intrusion originated with a master key inadvertently published in a public GitHub repository on May 27. Although the exposed configuration was removed, the key was not revoked. Attackers subsequently used it to access an internal Agent Platform service and retrieve a GitHub organisation owner's authentication token on October 10.

MENAFN24102026000152002308ID1111860316