{"slug": "litellm-exposes-github-token-leak-behind-malicious-package-release", "title": "LiteLLM Exposes GitHub Token Leak Behind Malicious Package Release", "summary": "A GitHub token leak occurred when Claude Code embedded a user's GitHub CLI OAuth token into a response body, potentially exposing it in LiteLLM logs, according to a recent investigation. The leak led to a compromised release pipeline and a poisoned package, LiteLLM v1.107.0, pushed to multiple registries on October 21, 2026.", "body_md": "A recent investigation revealed that a GitHub token leak was behind a malicious package release, specifically when Claude Code embedded a user's GitHub CLI OAuth token into a response body, potentially exposing it in LiteLLM logs. This led to a compromised release pipeline and a poisoned package, LiteLLM v1.107.0, being pushed to multiple registries on October 21, 2026.", "url": "https://wpnews.pro/news/litellm-exposes-github-token-leak-behind-malicious-package-release", "canonical_source": "https://osintsights.com/litellm-exposes-github-token-leak-behind-malicious-package-release", "published_at": "2026-10-22 09:21:18+00:00", "updated_at": "2026-10-22 09:41:06.241766+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "large-language-models", "developer-tools"], "entities": ["LiteLLM", "Claude Code", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/litellm-exposes-github-token-leak-behind-malicious-package-release", "markdown": "https://wpnews.pro/news/litellm-exposes-github-token-leak-behind-malicious-package-release.md", "text": "https://wpnews.pro/news/litellm-exposes-github-token-leak-behind-malicious-package-release.txt", "jsonld": "https://wpnews.pro/news/litellm-exposes-github-token-leak-behind-malicious-package-release.jsonld"}}