1-minute read
What a defender needs to know
Someone with push access to LiteLLM’s GitHub repository ran a secret-stealing Actions workflow on October 10, eleven days before the poisoned litellm==1.107.0 release. Socket recovered a one-job commit on ci-tmp-a351cc that named six organization secrets, including GH_TOKEN and a GitHub App private key. A second commit on ci-tmp-4d8517 ran six jobs on October 12, reaching organization and five GitHub Environment scopes and naming 14 further secrets. Both branches were deleted. Their Actions run metrics and environment deployment records remained available after deletion.
Preserve Actions runs, repository activity and environment deployments from October 10 through October 21. Match .github/workflows/cache.yml, the two ci-tmp- refs, commits b69bc36fd4e23b23ea09f4ce63a92b07258f5044 and 1a6e3c1e41f1b5c8eeaeeb2ae94bcd95390fa891, and deployment subject ci: bump cache config. If retained network logs are available, match the full collector URLs https://webhook.site/65a42464-3cfa-4b02-a18c-17a6d7b86f37 and https://webhook.site/4da03473-a3e7-4dc2-a087-9c564b4208e1. The shared webhook.site service carried these attacker-selected endpoints. The jobs suppressed send failures, so a successful run means execution; scope rotation to the secrets available to each job.
Revoke implicated GitHub tokens and App keys; rotate provider, database and other referenced keys, and invalidate the Linear browser session state if it was exposed. Verify the old credentials fail authentication and reconcile the October 10 run and October 12 environment deployments with the rotated-secret inventory. Separately recover any hosts that installed the malicious wheels or pulled affected Docker images on October 21.