New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

Socket’s threat research reports that attackers with push access to the BerriAI/litellm GitHub organization executed secret-exfiltration GitHub Actions workflows on October 10 and 12, 2026, at least 11 days before malicious LiteLLM packages and container artifacts were published on October 21. The attackers created short-lived branches, added a workflow disguised as a cache configuration change, triggered it through pushes in the upstream repository context, collected organization and environment-scoped secrets, transmitted encoded data to webhook.site endpoints, and deleted the branches within minutes. Repository metrics, activity logs, and environment deployment records corroborate that the workflows ran successfully, though successful transmission of the secrets cannot be confirmed because the workflows suppressed errors. The workflows targeted 20 credentials, including GitHub tokens, GitHub App credentials, AI service API keys, database and Redis credentials, GitGuardian access, and a serialized Linear browser session. LiteLLM’s subsequent investigation linked the initial compromise to an Agent Platform master key publicly committed in May and not revoked, which reportedly enabled retrieval of an organization owner token and further credential theft, while audit logs connected a token stolen in the October 10 workflow to approval of the malicious release. Socket concludes that the organization was compromised but could not determine the full duration and extent of activity, how the attributed account credentials were obtained, whether all stolen data reached the collectors, or how the credentials were ultimately used.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.