The attack chain behind the v1.107.0 LiteLLM release
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
LiteLLM's root-cause analysis says the malicious 1.107.0 release came from a master key committed to a public repo on May 27 and never revoked. On October 10 it yielded an org owner's GitHub token, which the attacker used to harvest two maintainers' tokens through CI. On October 21 they repointed the release workflow to a fork and approved the release with those tokens. The relaxed two-engineer approval rule helped. These details come from LiteLLM alone and were not independently verified.
Score
0.83total under rubric v2.0Contestedjudges differ by 0.49 on audience breadth
- Significance0.76
- Reader interest0.92
- Audience breadth0.65
- Practical relevance0.87
- Substantiated0.94
- Technical depth0.94
- New information0.95
- Counts against: Promotional0.03
- Counts against: Overclaim0.09
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.71 | 0.70 | 0.86 | 0.76 | 0.16 | +0.25 | +0.189 |
| Reader interest | 0.86 | 0.92 | 0.97 | 0.92 | 0.11 | +0.20 | +0.183 |
| Audience breadth | 0.33 | 0.80 | 0.82 | 0.65 | 0.49 , above the contested threshold | +0.10 | +0.065 |
| Practical relevance | 0.85 | 0.85 | 0.90 | 0.87 | 0.05 | +0.15 | +0.130 |
| Substantiated | 0.95 | 0.90 | 0.98 | 0.94 | 0.08 | +0.10 | +0.094 |
| Technical depth | 0.97 | 0.90 | 0.94 | 0.94 | 0.07 | +0.10 | +0.094 |
| New information | 0.92 | 0.95 | 0.99 | 0.95 | 0.07 | +0.10 | +0.095 |
| Promotional | 0.05 | 0.03 | 0.01 | 0.03 | 0.04 | −0.15 | −0.004 |
| Overclaim | 0.13 | 0.10 | 0.03 | 0.09 | 0.10 | −0.15 | −0.013 |
| Sum of contributions | +0.833 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.833 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
Claim check
Claim check: 6 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
On May 27, 2026, a configuration file containing the master key to a LiteLLM Agent Platform deployment was committed to the public LiteLLM-Labs/lite-harness repository.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key”
The source says No passage could be compared.
Source cited by the article: github.com/LiteLLM-Labs/lite-harness/blob/e10b14a/harnesses/opencode/opencode.json
No source givenCausal conclusion
On October 10 the threat actor used the exposed master key to access the LiteLLM Agent Platform and extract a GitHub CLI OAuth token belonging to the GitHub organization owner, giving owner-level access to all repositories.
The article gives no link or citation for it.
The article says “On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token”
The source says No source to compare with.
No source givenDate
The malicious releases were published to LiteLLM's public registries at around 4:40 AM PDT (11:40 UTC) on October 21.
The article gives no link or citation for it.
The article says “The malicious releases were published to our public registries at around 4:40 AM PDT (11:40 UTC”
The source says No source to compare with.
No source givenDate
The PyPI releases were frozen by 6:23 AM PDT and the Docker images were removed by 7:20 AM PDT.
The article gives no link or citation for it.
The article says “The PyPi releases were frozen by 6:23 AM PDT (13:23 UTC”
The source says No source to compare with.
No source givenCausal conclusion
The release restriction requiring approval by a special account locked to a physical device was relaxed earlier that week, allowing any two engineers to trigger and approve a release.
The article gives no link or citation for it.
The article says “This restriction was relaxed earlier this week to accommodate the temporary push for more frequent releases and bugfix backports, allowing any two engineers to trigger and approve a release”
The source says No source to compare with.
No source givenNumber
Seven litellm==1.107.0 wheels were published to PyPI between 11:39:51 and 11:40:13 UTC on October 21.
The article gives no link or citation for it.
The article says “Seven PyPI wheels went out between 11:39:51 and 11:40:13”
The source says No source to compare with.
Couldn’t checkNumber
LidorMachluf caught the malicious release within 20 minutes of publication.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “catching the malicious release within 20 minutes of publication”
The source says No passage could be compared.
Source cited by the article: github.com/BerriAI/litellm/issues/47826
No source givenNumber
The compromised artifacts were live for about two hours before being pulled.
The article gives no link or citation for it.
The article says “The compromised artifacts were live for about two hours before they were pulled”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 17 pts, front page
Recorded for context only, checked 24 Oct 2026, 08:53 UTC. It played no part in the ranking.