LiteLLM Traces Its Poisoned Release to Stolen GitHub CLI Tokens

LiteLLM now says how the attacker got in, and Wiz says what the attacker did next.

LiteLLM’s incident update, posted at 20:30 UTC on October 21, says the attacker held GitHub CLI credentials belonging to three developers. Release permissions had been expanded for two engineers on Monday. An org-owner token was used to disable branch protections, then the release workflow was pointed at a lookalike repository, Berri-AI/litellm.

LiteLLM says Claude Code will, in some situations, “embed a user’s GitHub CLI OAuth token into a response body,” and that such tokens may appear in LiteLLM logs. It also found an unexpected, innocuously named user account in its internet-exposed internal deployment. Access there likely came through a recently patched vulnerability, LiteLLM says, though that is unconfirmed.

Wiz says stolen AWS instance-role credentials were used about 4.5 hours after exfiltration, from 16:20 to 17:01 UTC. The calls started with sts:GetCallerIdentity and moved to listing Amazon Bedrock models, which Wiz calls “consistent with LLMjacking,” plus some IAM enumeration. The Hacker News reports Socket found no link to a March attack on the project.

LiteLLM says its enterprise private registry was unaffected, and that an embargoed vulnerability disclosure is set for October 27.