Feross(@feross):Attackers were stealing secrets from LiteLLM's GitHub org 11 days before the malicious litellm 1.107.0 release. The trick: push a workflow to a throwaway branch, let on: [push] run it with real secrets, delete the branch. 20 secrets taken, including a GitHub App private key.

Feross

@feross

Protecting America's software supply chain Founder & CEO @SocketSecurity ( Created @WebTorrentApp and @StandardJS Taught Web Sec @Stanford

Joined August 2008

1.7K Following 41.3K Followers

Feross@feross

2026.10.23 21:58

Attackers were stealing secrets from LiteLLM's GitHub org 11 days before the malicious litellm 1.107.0 release. The trick: push a workflow to a throwaway branch, let on: [push] run it with real secrets, delete the branch. 20 secrets taken, including a GitHub App private key.