Follow-up on the LiteLLM backdoor: they published the root cause, and it started five months earlier.
- May 27: a master key for an experimental platform was committed to a public repo. It was force-pushed away, but never revoked.
- Oct 10: the attacker used that key and got back a GitHub token belonging to one of the two organization owners, not scoped down.
- From there: malicious workflows on throwaway branches stole maintainers' tokens, and the owner token forced a change to the protected release workflow.
- Oct 21: poisoned 1.107.0 on PyPI and Docker.
Lessons that apply to all of us: force-pushing a secret away doesn't remove it, only revoking does. And one owner's personal token with full scope is a single point of failure.
https://www.webpronews.com/litellm-1-107-0-attack-chain-unrevoked-master-key
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-25 11:18:11 UTC
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-25 11:18:11 UTCEvent JSON
{
"id": "eb2336cad9c8dcb12f548bf00ff605980c37b127c8345eef1d3fb3c56152932a",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792927091,
"kind": 1,
"tags": [],
"content": "Follow-up on the LiteLLM backdoor: they published the root cause, and it started five months earlier.\n\n- May 27: a master key for an experimental platform was committed to a public repo. It was force-pushed away, but never revoked.\n- Oct 10: the attacker used that key and got back a GitHub token belonging to one of the two organization owners, not scoped down.\n- From there: malicious workflows on throwaway branches stole maintainers' tokens, and the owner token forced a change to the protected release workflow.\n- Oct 21: poisoned 1.107.0 on PyPI and Docker.\n\nLessons that apply to all of us: force-pushing a secret away doesn't remove it, only revoking does. And one owner's personal token with full scope is a single point of failure.\n\nhttps://www.webpronews.com/litellm-1-107-0-attack-chain-unrevoked-master-key",
"sig": "c7062e9f93c65336d9b7f3e20f1642358f413a7344480ce22f26862e0596a272aefce1dfd0f5ecfff1a1a0ec7536a283aea8e849759d1fa2b213a0ee8681cbd9"
}