LiteLLM Traces Malicious Release to Master Key Left Unrevoked

LiteLLM traced its malicious v1.107.0 release to an Agent Platform master key committed to a public repository in May and left active, linking the Oct. 21 compromise to a credential exposure that began months earlier. LiteLLM’s open-source gateway lets applications connect to more than 100 large language model providers through a single interface. The new root-cause timeline adds to earlier coverage of the release’s credential risks and remediation , detailing how the incident reached the release pipeline. A configuration file containing the master key was committed to the public LiteLLM-Labs/lite-harness repository May 27.

Source: TokenPost