https://youtu.be/vxE3XbcLCa8

LiteLLM published its root-cause report on Oct 23. According to LiteLLM, a master key for its Agent Platform was committed publicly on May 27. The team found the leak and rewrote the commit, but the key wasn’t revoked.

LiteLLM says the attacker used that key on Oct 10 to get a GitHub org owner’s token, then took two maintainers’ tokens. Branch protections were disabled. The release was built from a lookalike repo, Berri-AI instead of BerriAI. Malicious 1.107.0 went out on PyPI and container images on Oct 21.

Separately, JFrog, Microsoft and Socket confirm the malware and some earlier malicious workflows. The full chain from the leaked key to the release rests on LiteLLM’s own account.