Incident report · Supply chain
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
On October 21, 2026, LiteLLM's release pipeline was compromised, leading to the distribution of a malicious version (1.107.0) of its Python package. Threat actors pushed a credential stealer and backdoor to Docker Hub and PyPI. LiteLLM suspects a GitHub token leak from its AI Gateway logs enabled the attack. The malicious package was available for an unspecified duration.
- Discovered
- Oct 22 2026
- Failure mode
- Supply chain
- Source
- The Hacker News · Oct 22 2026
- Impact
- Compromise of LiteLLM's release pipeline, distribution of malicious package (v1.107.0) containing credential stealer and backdoor to Docker Hub and PyPI. Potential data exfiltration via stolen credentials.
Summary from the public record. The failure mode’s analysis follows.
The agent was fine. Everything it trusted was not.
How Fencio prevents this
The agent trusted a component it had never verified: a package, an extension, a skill, or a server that looked legitimate. When that component changed or was compromised, the agent carried the payload straight into a trusted environment.
Fencio inventories every tool, server, and skill an agent can reach, pins their versions and declared capabilities, and blocks calls when a component starts doing something its manifest never declared, like reading env files or mailing new recipients.
Runtime policy example · Supply chainLive
- 16:37:43mcp.tool upload_file(.env)Capability not in pinned manifestBlock
- 16:40:00mcp.tool lint(src/)Manifest match · v1.4.2Allow
- 16:43:17pkg.install(unverified-name)Package not in approved registryBlock
Say yes to the AI your business wants.
Book a 30-minute call. Bring your agents and your rules.