LiteLLM Compromised in Fresh Supply Chain Attack

Executive Summary

Attackers used compromised GitHub CLI OAuth tokens to distribute malicious packages through PyPI and Docker, targeting the LiteLLM ecosystem. Teams running AI applications or agents with LiteLLM dependencies should review package integrity and supply-chain controls.

What Happened

Affected Products

• LiteLLM
• PyPI
• Docker
• GitHub CLI

Vulnerability / Attack Technique

AI supply-chain compromise using compromised OAuth tokens

Technical Mechanism

Compromised GitHub CLI OAuth tokens were used to push and approve malicious packages on PyPI and Docker. The summary does not provide further technical details about the packages or payloads.

AI Security Category

LLM03:2025 Supply Chain

Part of the AI Supply Chain and AI SBOM topic.

Relevant Frameworks

RealGround Analysis

AI agents and LLM applications can inherit risk from compromised libraries, container images, and package registries in their dependency chain. Teams should maintain an inventory of AI components and validate dependencies before deployment to reduce exposure to malicious updates.

Recommended Controls

• Maintain an SBOM covering LiteLLM, Python packages, Docker images, and transitive dependencies.
• Pin dependencies and verify package and container integrity using trusted hashes or signatures.
• Restrict, rotate, and continuously monitor GitHub CLI OAuth tokens and other package-publishing credentials.
• Require independent review and approval for package releases and registry publication workflows.
• Scan dependencies and container images for malicious or unexpected changes before deployment.

Related RealGround Service

AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.

Sources

securityweek.com: https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/

Summary and analysis written by RealGround from the source above; last updated 2026-10-23.