Poisoned Pipeline / Techniques / T0217
Build trusted artifacts from an attacker-controlled source
The attacker redirects a project's own trusted build or release
pipeline so that it builds from a source the attacker controls -
typically a lookalike repository one character away from the real
one - and lets the pipeline do the rest. The artifacts that come out
are produced, signed, and published by the legitimate infrastructure
under the legitimate publisher identity, so every downstream check
that asks "did the real publisher ship this?" answers yes. What the
checks do not ask is whether the recorded input source was the real
project. The payload never appears in the real repository or its
release tags, so tag audits, source diffs of the official repo, and
"is the tag clean?" heuristics all pass.
Observed in the LiteLLM 1.107.0 compromise (21 October 2026): the
attacker held GitHub CLI OAuth tokens of three developers taken from
the logs of an internet-exposed internal deployment, used one to
modify the private release workflow, used an organization owner's
token to override branch protection after the normal push path was
rejected, and pointed the workflow's source input at the lookalike
repository Berri-AI/litellm (one hyphen off from BerriAI/litellm).
The lookalike source carried ten stacked commits on top of the real
tag adding a payload directory and one build-config line. The
official pipeline built, signed, and published the poisoned wheels
and container images; the container provenance recorded the
lookalike source honestly and still validated. Provenance vouches
for recorded inputs, not for their trustworthiness.
Distinct from T0206 (forging or omitting provenance - here the
provenance is genuine), T0121 (replacing an already-built artifact -
here the artifact is freshly built by the victim's own pipeline),
and T0109 (publishing an attacker-authored package under an
attacker identity - here the publisher identity is the victim's).
Where this idea came from
- https://www.litellm.ai/blog?post=security-incident-oct-21-2026
- https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
- https://socket.dev/blog/litellm-compromise
Mitigations
- M1730 Implement code reviews
- M1732 Implement code scanning for security risks
- M1661 Revoke user permissions
- M1662 Evaluate pipeline execution permissions
- M1500 Verify third-party artifacts and open-source libraries
Detections
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1262 Implement vulnerability assessment
- D1260 Implement regular security audit and review