What happened
Open-source AI gateway LiteLLM disclosed on Wednesday that a poisoned version of its software had been published. According to the company's incident report, attackers obtained the keys they needed from LiteLLM's own logs.
Where the tokens came from
The report says the GitHub tokens in question were exposed through Anthropic's coding agent, Claude Code. LiteLLM engineers found that the credentials in the logs were used to publish the malicious release.
Why it matters
LiteLLM provides a single interface to different AI models, making it a core piece of infrastructure for many developers. A supply-chain attack of this kind carries the risk of compromising the systems of teams and organizations that use the software. The incident report was signed by the company's CEO, CTO and director of security.
What to do
Teams using LiteLLM are advised to check their versions and rotate their GitHub tokens. Credentials left in logs by coding agents should also be reviewed.
