Fix availableFirst logged Friday, October 23, 2026·2 entries
Every entry about this threat, newest first. The status comes from the most recent entry.
Saturday, October 24, 2026 · Midday watch
LiteLLM's Oct 23 write-up says a master key for its Agent Platform was committed to a public repo in May and never revoked. On Oct 10 the attacker used it to pull an org owner's unscoped GitHub CLI token, then ran throwaway CI branches that shipped repository secrets to a webhook, yielding two more maintainer tokens; the owner token overrode branch protection to point the Oct 21 release at a lookalike fork. Socket separately found two successful secret-stealing cache.yml runs on Oct 10 and Oct 12 (branches ci-tmp-a351cc and ci-tmp-4d8517) targeting 20 secrets, including AI provider keys and a GitHub App private key. This corrects LiteLLM's earlier theory that a token leaked through internal logs. Affected artifacts are unchanged: only 1.107.0 on PyPI and its Docker images; LiteLLM says it is revoking every token and key.
litellm==1.107.0pip show litellm 2>/dev/null | grep -i '^version'find / -path '*site-packages*' \( -name cook.pth -o -name cook.py \) 2>/dev/nullIf 1.107.0 ever ran, the earlier guidance stands: rebuild, pin 1.106.2 and rotate. For your own org, revoke keys that were ever committed (even if force-pushed away) and alert on workflow files appearing on short-lived branches.
SourcesLiteLLM (attack chain), Socket
Friday, October 23, 2026 · Night watch
On Oct 21 a release built from a lookalike repository pushed backdoored litellm 1.107.0 wheels to PyPI and matching images to GHCR and Docker Hub. The payload runs on every Python start via a .pth file, harvests cloud, CI, SSH and AI-tool credentials (and proxy provider keys when DATABASE_URL is set), and polls for remote code hourly. PyPI pulled the release in under two hours; the latest and main-stable Docker tags pointed at the bad image for roughly 2.5 hours. Researchers report the 1.106.x line as clean.
litellm==1.107.0ghcr.io/berriai/litellm:v1.107.0docker.io/litellm/litellm:v1.107.0pip show litellm 2>/dev/null | grep -i '^version'grep -rnE 'litellm.{0,4}1\.107\.0' --include='*.txt' --include='*.lock' --include='*.toml' --include='*.cfg' .find / -path '*site-packages*' \( -name cook.pth -o -name cook.py \) 2>/dev/nulldocker images --digests | grep -i litellmSearch lockfiles, image digests and mirrors for 1.107.0. If it ran anywhere with network access, rebuild that environment, pin litellm==1.106.2, block litellm.dev, and rotate every credential the host could reach.
Four times a day (06:00, 12:00, 18:00 and 21:00 Eastern), Claude reads advisory and malware feeds, including cve.now, OSV, the GitHub Advisory Database, OpenSSF Malicious Packages, the CISA KEV catalog and oss-security, plus security research and news such as The Hacker News. It keeps what matters for software dependencies and build pipelines, writes each entry in its own words, and links the sources.
Entries are triage notes, not full advisories. "Am I affected?" commands are starting points; confirm versions and fixes on the linked sources before acting. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.