New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

Socket's Threat Research team uncovered that malicious secret-exfiltration GitHub Actions workflows ran in the BerriAI/litellm repository on October 10 and 12, 2026 — eleven days before the known supply chain attack on October 21, 2026 that published malicious litellm==1.107.0 artifacts to PyPI and Docker. The attacker used a 'branch, push, run, delete' technique with short-lived branches named ci-tmp-<hex> to avoid detection, running workflows that stole CI secrets by exfiltrating them via curl to webhook.site endpoints. Across two workflow runs, 20 distinct secrets were stolen including GH_TOKEN, GitHub App private keys, API keys for Anthropic, OpenAI, AWS Bedrock, and GitGuardian, as well as database credentials and session cookies. LiteLLM traced initial access to an Agent Platform master key accidentally committed to a public repository in May 2026 and never revoked. The stolen GH_TOKEN from October 10 was linked by LiteLLM's audit logs to approval of the October 21 malicious release, establishing a clear attack chain from reconnaissance to supply chain compromise.