CyberFlash· 24 octobre 2026EN · en anglais

LiteLLM: a forgotten key, a poisoned package

Version 1.107.0 of the LiteLLM Python package stayed online for 1 h 43 min carrying a credential stealer. The code runs when Python starts, even if the application never imports LiteLLM: uninstalling the package is not enough.

Actualité du 24 octobre 2026 · 2 min 03 · 6 sources · 11 affirmations sourcées

En 30 secondes

An exposed key that was never revoked opened the release pipeline, not the application code.
The poisoned package runs when Python starts, even if the application never uses LiteLLM: uninstalling is not enough.
Pin versions, revoke secrets, limit token scope: three habits that break this chain.

Les faits

Ce qui est établi, et ce qui ne l'est pas

Chaque affirmation de l'épisode, son statut et ses sources.

ÉtabliVersion 1.107.0 publiée sur PyPI le 21 octobre 2026 entre 11 h 39 et 11 h 40 UTC, mise en quarantaine à 13 h 23 UTC[1][2][5]
RapportéEnviron 49 000 téléchargements pendant la fenêtre d'exposition, selon une estimation[4]
ÉtabliImages Docker Hub et GHCR piégées de 11 h 46 à 14 h 20 UTC[1][5]
ÉtabliClé maître d'une plateforme d'agents commitée dans un dépôt public le 27 mai 2026, jamais révoquée[2]
ÉtabliLe 10 octobre 2026, cette clé a renvoyé le jeton OAuth GitHub d'un propriétaire d'organisation, non restreint[2]
ÉtabliLe pipeline a construit la version depuis un dépôt sosie, Berri-AI au lieu de BerriAI[2][3][5]
ÉtabliLe code s'exécute au démarrage de Python via cook.pth puis sitecustomize.py, hors du dossier de l'application, même si LiteLLM n'est pas importé[3][5][6]
ÉtabliCollecte d'identifiants cloud, de clés d'API d'IA, de clés SSH et de données de navigateur, envoi vers litellm[.]dev/healthcheck[5][4][3]
InconnuNombre de machines piégées, exfiltration réelle chez des tiers et identité de l'attaquant non établis[1][4]
ÉtabliSignalement par un chercheur indépendant moins de 30 minutes après la publication (12 h 06 UTC)[2][5]
ÉtabliRecommandations : figer les versions, révoquer les clés exposées, restreindre la portée des jetons, chercher les fichiers de démarrage hors du dossier de l'application[1][3]

Transcription

On October 21, at 11:39 UTC, version 1.107.0 of LiteLLM goes out on PyPI with a credential stealer inside. It stays online for less than two hours: about 49,000 downloads.

CyberFlash is DecodeVox's cybersecurity show. Here, we go beyond the headlines: we decode attacks, reveal how they work, and explain what they really change.

On PyPI, the package stays up for 1 hour 43 minutes. The Docker images are pulled at 14:20 UTC, after 2 hours 33 minutes. According to Microsoft, simply starting Python was enough to run the code, without importing LiteLLM.

So why isn't uninstalling the package enough?

It all starts with a master key committed to a public repository in May, and never revoked. On October 10, it unlocks an agent platform holding a GitHub token from an organization owner. With that token, the pipeline builds from a lookalike repository, Berri-AI instead of BerriAI: seven poisoned wheels go out on PyPI.

What we know: three files run every time Python starts, even without importing LiteLLM. What we don't know: how many machines are infected, whether secrets got out, and who is behind it.

Three habits. Pin the versions you install, instead of following the latest release. Revoke an exposed key the day you find it, and limit the scope of your tokens. Finally, look for startup files left outside the application: uninstalling is not enough.

A key forgotten in May poisoned a package downloaded tens of thousands of times. The supply chain is invisible: it just gets installed.

To go further, find today's full edition on our website, link in the description. Subscribe to DecodeVox so you never miss our next breakdowns. And tell us in the comments: Did you know installing a package could be enough to compromise a machine?

Les mots de l'épisode

Package: A software archive installed by a dependency manager, here pip for Python. The package carries a name and a version, not a guarantee of its content.
Release pipeline: The automated chain that builds, signs and publishes a software release. If it is hijacked, the published file still looks official.
OAuth token: A kind of technical password issued to an application. Without restrictions, it carries its owner's rights, here those of a GitHub organization owner.
Python startup: The moment the interpreter loads its environment, before running the program. Files placed there run on every launch.

Sources