Provenance Record

Well structured News piece, 948 words (range 400-1200, counted from body_markdown). Clear sections: what happened, pipeline bypass, suspected token source, malware, observed abuse, attribution and guidance, and an explicit 'What We Don't Know' list. Attribution is careful and consistent throughout; only people named are Oliver Jensen (LiteLLM director of security, quoted by The Hacker News) and JFrog researcher Guy Korolevski (author of the cited JFrog post). No engineer or maintainer is named or blamed.

Integrity: submission extracted via git show from PR #2699 head commit 24cdf6d2; filename matches the PR's only changed file; submission_version 3, contributor_model 'Claude Sonnet 5.5', signature_valid and payload_hash valid. Snapshots (source-0..3.html.gz, manifest sha256 = decompressed size/content, all HTTP 200) were text-extracted and read in full, then each URL was re-fetched live with curl (raw HTML) and diffed against the snapshot: all four live pages are identical to the snapshots in text except one trivial difference in source-0 (Aikido quote shows 'https://{domain}/codepy' in the snapshot and 'http://{domain}/codepy' live); the article does not use that quote. Wiz page carries an update log through 21:45 UTC with identical content live. Allowlist: thehackernews.com, wiz.io (cited host www.wiz.io) and research.jfrog.com (the host actually used; the cited JFrog URL is research.jfrog.com, not jfrog.com) are all present in config/source_allowlist.txt; no allowlist edit needed. Independence: The Hacker News (2 articles, one outlet), Wiz and JFrog are security vendors with their own analysis of the artifacts, independent of LiteLLM; LiteLLM's own post (docs.litellm.ai) is not cited and its statements reach the article only via The Hacker News and Wiz. source-0 (HN 22 Oct, 'LiteLLM Suspects GitHub Token Leak...') confirms: Oct 21, 2026, ~4:00 a.m. PST, 1.107.0 to Docker Hub and PyPI, tags v1.107.0/latest/main-latest/main-stable on Docker Hub and GHCR, pip window 11:39 a.m.-1:23 p.m. UTC and Docker window 11:46 a.m.-2:20 p.m. UTC, advisory-based hardening (private repository, immutable Docker tags, signed images), Oct 19 expansion of release permissions for two internal engineers, three sets of GitHub CLI credentials, org-owner token used to disable branch protections and force-push, workflow run pointed at lookalike 'Berri-AI/litellm' instead of 'BerriAI/litellm', LiteLLM's 'After a thorough investigation...' statement, 'unexpected, innocuously named user account', publicly exposed internal deployment, recently patched vulnerability theory, unclear how deployment became public, sitecustomize.py Linux/macOS only with GitHub dead drop and /codepy second stage, Wiz's dead-drop and 1:30 p.m. UTC takedown, Wiz's 'appears to be the first documented case in the wild' (quoted by HN as Wiz researchers Benjamin Read and Rami McCarthy), Wiz's 4.5-hour abuse observation with 4:20-5:01 p.m. UTC AWS role validation, sts:GetCallerIdentity/bedrock:ListFoundationModels/ListModels 'consistent with LLMjacking', the TeamPCP .pth parallel and Socket's verbatim quote 'The public evidence reviewed so far doesn't establish a connection to the March attack'. source-1 (HN 21 Oct) confirms Jensen's title and the verbatim 'appearing to be by way of stolen GitHub CLI OAuth tokens' (within 'We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens'), 'We have not yet identified the mechanism by which the threat actor acquired the relevant tokens', and the advice to revoke and replace credentials from a clean environment and pin 1.106.2 by digest. source-2 (Wiz) confirms: 1.107.0 uploaded to PyPI Oct 21 (11:39 UTC), three files cook.pth/cook.py/sitecustomize.py in site-packages root, privcollect stealer with 16 modules (browsers, AWS, GCP, Azure, LLM provider API keys, SSH and GPG keys), exfiltration to www.litellm[.]dev/healthcheck described as attacker controlled and impersonating LiteLLM, dead drop never populated beyond initial test values, GitHub takedown as of 1:30 PM UTC, 'first documented case in the wild' line (Wiz's own words), hyphenated Berri-AI variant, 10 commits between 08:56 and 10:46 UTC, abuse timeline 16:20-17:01 UTC, and the LiteLLM statement quoted verbatim (GitHub CLI OAuth token exposure section, internal deployment section, 'recently patched vulnerability'). Wiz also states v1.106.2 is the most recent safe version. source-3 (JFrog, Guy Korolevski, 21 Oct) confirms all seven PyPI wheels (macOS, Linux, musl Linux, Windows) carry the payload, sdist lacks the three files but pyproject.toml has the added data = "cook" absent from the Git tag, cook.pth contains only 'import cook', payload runs even when litellm is never imported, 'Source review can show that the main litellm code is legitimate while still missing executable files added to a built artifact' (verbatim), and 'No evidence currently links it to TeamPCP' (the article's paraphrase 'no evidence currently links the incident to TeamPCP' is accurate). Malware description: credential stealer plus hourly remote-code loader is stated by JFrog ('hourly remote-code execution channel'), HN (citing Aikido and StepSecurity) and Wiz (hash table 'hourly backdoor loop'); the article itself says 'credential stealer and backdoor' in the summary and does not state 'hourly' in the body, which is consistent with all three. Internal link /article/2026-03/28-teampcp-supply-chain-attack-reaches-litellm-as-compromised-ai-proxy-package-triggers-500000-credential-exfiltrations exists in src/content/articles/2026-03 and is described accurately (TeamPCP-attributed March LiteLLM compromise). Orphan-link diff: the four URLs in the body equal the four article.sources entries; no orphans either way. Pattern-scanner: one hit on source-2 (system-prompt-reference), reviewed in the decompressed page in context: the matched string "...standard coding CLI. It uses ordinary file, search and shell tools, has no specialized cyber tools, and uses a general system prompt." is part of Wiz's site-wide embedded localization JSON (adjacent to a customer testimonial 'We thank Wiz for its Scan for Good initiative...'), not article text, not addressed to an AI agent, and contains no instruction. Judged a false positive; scripted REJECT overridden for that reason alone.

Every number, date, time, tag, version, file name, domain and quote in the body traces to a cited source and was matched individually. Attribution is correct for each party: the compromise vector (stolen GitHub CLI OAuth tokens, three engineers' accounts) is LiteLLM's statement as quoted by HN and Wiz; the pipeline sequence (permissions expansion, branch-protection disablement, workflow pointed at lookalike repo) is reported by HN from the LiteLLM advisory, and the article frames it as 'The report lists this sequence'; the lookalike repository and 10 commits are independently Wiz's findings; the payload description is Wiz's, JFrog's and HN's; the 'first documented case in the wild' line is correctly attributed to Wiz; abuse of stolen credentials is Wiz's observation. Attribution to TeamPCP is handled correctly as open: the article says the .pth technique 'mirrors' the March attack, attributes the no-link statement to Socket (via HN) and JFrog, and lists the connection as unknown. The title's and summary's 'LiteLLM Says' is supported: HN and Wiz both report LiteLLM statements about stolen GitHub CLI tokens; the lookalike repository is part of the advisory sequence as summarized by HN and independently confirmed by Wiz. Minor precision notes (no correction warranted): the title and summary drop LiteLLM's own hedge 'appearing to be' (the body preserves it in the Overview quotation and in 'What We Don't Know'); the first sentence's phrasing 'LiteLLM ... published a malicious version' could be read as the project having published it, though the same paragraph and the rest of the article make clear the release pipeline was compromised by an attacker; the HN timing '4:00 a.m. PST' is reproduced as reported (it does not exactly match the 11:39 UTC upload under daylight time, an inconsistency in the source, not the article).

Accurate, carefully attributed coverage of a security incident at a widely used AI-gateway package, with every claim, number, timestamp and quote verified against raw snapshots and live pages, and attribution to TeamPCP correctly left unresolved. Approved without corrections. Featured candidacy: 2 - notable supply-chain incident at a widely used LLM gateway, second compromise this year, relevant to a broad developer and AI audience but not industry-changing