--- title: LiteLLM says hackers poisoned it with GitHub tokens... description: Hackers published a poisoned LiteLLM release after stealing GitHub tokens that leaked into the company's own logs. LiteLLM says Claude Code sometimes puts a... canonical: https://daily.dev/posts/litellm-says-hackers-poisoned-it-with-github-tokens-leaked-via-claude-code-6dmllolii twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: LiteLLM says hackers poisoned it with GitHub tokens leaked via Claude Code | daily.dev og:description: Hackers published a poisoned LiteLLM release after stealing GitHub tokens that leaked into the company's own logs. LiteLLM says Claude Code sometimes puts a... og:url: https://daily.dev/posts/litellm-says-hackers-poisoned-it-with-github-tokens-leaked-via-claude-code-6dmllolii og:image: https://api.daily.dev/og/posts/6DmlloliI.png og:image:alt: LiteLLM says hackers poisoned it with GitHub tokens leaked via Claude Code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # LiteLLM says hackers poisoned it with GitHub tokens leaked via Claude Code **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary Hackers published a poisoned LiteLLM release after stealing GitHub tokens that leaked into the company's own logs. LiteLLM says Claude Code sometimes puts a user's GitHub CLI OAuth token into a response, and if something logs those responses the tokens may end up in its logs. The attacker used three stolen developer credentials to disable branch protection, push version 1.107.0 from a lookalike repo, and delete workflow records. The package sat on PyPI for under two hours, racked up about 49,000 downloads, and installed a credential stealer plus a backdoor; Wiz later saw stolen AWS keys tested against Bedrock. LiteLLM urges users to pin version 1.106.2 or another release published before the attack and rotate every secret the affected machines could reach. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did hackers compromise the LiteLLM PyPI package in October 2026? Attackers obtained GitHub CLI OAuth tokens that had leaked into LiteLLM's own internal logs, because Claude Code sometimes embeds a user's GitHub token in its responses. Using three stolen developer credentials, they disabled branch protection, published a poisoned version 1.107.0 from a lookalike repository, and deleted workflow records to cover tracks. _Teams running AI coding agents in logged environments can follow incidents like this on daily.dev to catch similar credential-leak risks early._ ### What did the malicious LiteLLM 1.107.0 package actually do once installed? It installed a credential stealer and a backdoor that activated when Python started, using both .pth files and sitecustomize.py simultaneously. The stealer grabbed browser passwords, cookies, cloud keys, SSH keys, API keys, and AI provider keys from a LiteLLM proxy's database; the backdoor, working on Linux and macOS, polled a GitHub repo hourly for more code. _Anyone auditing Python supply-chain risks can track how malware like this evolves by following security coverage on daily.dev._ ### Which LiteLLM version should I use to avoid the October 2026 supply-chain attack? Pin to version 1.106.2 or any release published before the attack, since the poisoned 1.107.0 was live on PyPI only from 11:39 to 13:23 UTC on October 21 and as Docker images until 14:20 UTC. Affected users should also delete the three malicious files and rotate every secret reachable from compromised machines. _Developers pinning dependencies after a supply-chain scare can keep tabs on patch guidance like this via daily.dev._ ## Similar posts on daily.dev - [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments - [Hackers Hijacked a GitHub Actions Workflow to Push Malicious Code to PyPI](https://daily.dev/posts/hackers-hijacked-a-github-actions-workflow-to-push-malicious-code-to-pypi-sxmpfdzik) · It's Foss · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#github](https://daily.dev/tags/github), [#claude-code](https://daily.dev/tags/claude-code), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/litellm-says-hackers-poisoned-it-with-github-tokens-leaked-via-claude-code-6dmllolii) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"LiteLLM says hackers poisoned it with GitHub tokens leaked via Claude Code","url":"https://daily.dev/posts/litellm-says-hackers-poisoned-it-with-github-tokens-leaked-via-claude-code-6dmllolii","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/litellm-says-hackers-poisoned-it-with-github-tokens-leaked-via-claude-code-6dmllolii"},"datePublished":"2026-10-23T08:51:28.576Z","dateModified":"2026-10-23T08:52:30.263Z","description":"Hackers published a poisoned LiteLLM release after stealing GitHub tokens that leaked into the company's own logs. LiteLLM says Claude Code sometimes puts a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8a8328fbce15025e6e3c39811c6a629d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8a8328fbce15025e6e3c39811c6a629d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/litellm-says-hackers-poisoned-it-with-github-tokens-leaked-via-claude-code-6dmllolii","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,github,claude-code,litellm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"LiteLLM says hackers poisoned it with GitHub tokens leaked via Claude Code"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/litellm-says-hackers-poisoned-it-with-github-tokens-leaked-via-claude-code-6dmllolii#faq","mainEntity":[{"@type":"Question","name":"How did hackers compromise the LiteLLM PyPI package in October 2026?","acceptedAnswer":{"@type":"Answer","text":"Attackers obtained GitHub CLI OAuth tokens that had leaked into LiteLLM's own internal logs, because Claude Code sometimes embeds a user's GitHub token in its responses. Using three stolen developer credentials, they disabled branch protection, published a poisoned version 1.107.0 from a lookalike repository, and deleted workflow records to cover tracks. Teams running AI coding agents in logged environments can follow incidents like this on daily.dev to catch similar credential-leak risks early."}},{"@type":"Question","name":"What did the malicious LiteLLM 1.107.0 package actually do once installed?","acceptedAnswer":{"@type":"Answer","text":"It installed a credential stealer and a backdoor that activated when Python started, using both .pth files and sitecustomize.py simultaneously. The stealer grabbed browser passwords, cookies, cloud keys, SSH keys, API keys, and AI provider keys from a LiteLLM proxy's database; the backdoor, working on Linux and macOS, polled a GitHub repo hourly for more code. Anyone auditing Python supply-chain risks can track how malware like this evolves by following security coverage on daily.dev."}},{"@type":"Question","name":"Which LiteLLM version should I use to avoid the October 2026 supply-chain attack?","acceptedAnswer":{"@type":"Answer","text":"Pin to version 1.106.2 or any release published before the attack, since the poisoned 1.107.0 was live on PyPI only from 11:39 to 13:23 UTC on October 21 and as Docker images until 14:20 UTC. Affected users should also delete the three malicious files and rotate every secret reachable from compromised machines. Developers pinning dependencies after a supply-chain scare can keep tabs on patch guidance like this via daily.dev."}}]} ```