Provenance Record

Clear, well-structured News follow-up (958 words, within 400-1200). Reconstructs LiteLLM's revised account, the two exfiltration commits and the release sequence, with a What We Don't Know section. Neutral tone; no AI self-reference; no individual blamed (commit author shown by GitHub, ishaan-berri, is correctly not named since the token was stolen; the named people are LiteLLM's post authors and the issue reporter, all credited by name in the primary source).

Read all six snapshots from disk (source-0..5.html.gz); manifest has no suspicious_patterns for any source. source-0 (root-cause post, Oct 23, authors Oliver Jensen Director of Security and Mateo Wang AI Engineer): confirms May 27 commit of opencode.json with Agent Platform master key to LiteLLM-Labs/lite-harness, 'key revocation did not occur for the master key', non-service-account unscoped GitHub CLI OAuth token of an org owner, Oct 10 21:27:10 token returned, b69bc36 22:11:45, litellm-auto RELEASE_PLEASE_TOKEN, runs deleted, 1a6e3c1 'minimally sensitive secrets and minimally funded provider keys', Socket reached out Oct 22 17:38, 9cf97e9 10:08:29 rejected / 10:08:34 bypass, 20535d8f on Berri-AI/litellm, gate approved 11:11:18, seven wheels 11:39:51-11:40:13, run records deleted 11:53:49/11:54:01, revert and force-push of main, issue 47826 at 12:06:41, 'next week' for process changes, and all quoted passages (the 'first post suspected...' quote is truncated at 'different service' with a full stop inside the quotes, immaterial). source-1 (original incident post): confirms the earlier log-leak theory ('obtained the GitHub CLI OAuth tokens from its logs', 'currently suspect it was through a recently patched vulnerability') and a notice that its assumptions were 'inaccurate or incomplete' with a link to the canonical post. source-2/3 plus GitHub API: b69bc36 authored/committed 2026-10-10T22:11:45Z, message 'ci: bump cache config', adds .github/workflows/cache.yml, 24 lines, six secrets incl. GH_TOKEN, base64 then curl to webhook.site with '|| true'; 1a6e3c1 dated 2026-10-12T12:16:00Z, 97-line cache.yml with six jobs, first job reads ANTHROPIC_API_KEY, AWS_BEARER_TOKEN_BEDROCK, GITGUARDIAN_API_KEY, LENS_READ_TOKEN, OPENAI_API_KEY, PROVIDER_ISSUE_WEBHOOK_URL. 'Secret-stealing' / exfiltration characterization is accurate on the code and is also LiteLLM's and Socket's own characterization. source-4/API: issue 47826 created 2026-10-21T12:06:41Z by LidorMachluf. source-5 (Socket, snapshot fetched OK despite curl 403): title 'New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack', author Karlo Zanki, published 2026-10-23T21:00:31Z; it recovered b69bc36 and 1a6e3c1 and states the Oct 10 activity. The headline attribution to Socket and the Oct 23 date are therefore directly supported by Socket's own page, not just a summary. '11 days': Oct 10 to Oct 21 = 11 calendar days (about 10.6 days by timestamps); article labels it the Herald's own count, and Socket independently says eleven days. Live re-fetch: both docs.litellm.ai pages byte-identical in size to snapshots (59673 and 48920 bytes). Independent sources: Socket and the GitHub commit/issue data are independent of LiteLLM's narrative; LiteLLM is the primary source for the revision itself.

All numbers, times, names, commit hashes and quotes check out against raw text. Headline, summary and lead each supported (root cause per LiteLLM; Oct 10/12 workflows per GitHub commits and Socket). Attributions are correct throughout.

Accurate, well-sourced follow-up on a notable supply-chain incident; ready for publication. Featured candidacy: 2 - significant supply-chain incident affecting a widely used AI gateway, but a follow-up to already-covered news