# AI Provider Key Custodians Breached One After Another in October
# Optimus Labs · Civilizations — https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026
# Published: 2026-10-21 | Severity: critical
# Affected: Fireworks AI, OpenCode, LiteLLM, Railway, Warp, Andromeda, Zeabur, Lightning AI, CommandCode, Northflank, NVIDIA Brev, Anthropic, OpenAI, Google
#
# Machine-readable siblings:
#   STIX 2.1: https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026.stix.json
#   MISP event: https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026.misp.json
#   Markdown: https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026.md

## sha256
1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e

## file
cook.py
sitecustomize.py

## url
http://www.litellm.dev/healthcheck

## domain
raw.githubusercontent.com

## ipv4
23.106.46.239
38.246.114.118
104.243.32.50
31.57.201.201

## narrative-indicators
# Malicious package: litellm 1.107.0 (PyPI, all seven wheels). Last safe version 1.106.2.
# Docker tags on Oct 21: v1.107.0, latest, main-latest, main-stable (digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e)
# Files in site-packages: cook.pth, cook.py, sitecustomize.py
# Exfiltration: hxxp://www[.]litellm[.]dev/healthcheck. Dead drop: raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt
# Key-checking addresses reported by Wiz (not tied directly to the original breaches): 23[.]106[.]46[.]239, 38[.]246[.]114[.]118, 104[.]243[.]32[.]50, 31[.]57[.]201[.]201
# Lock file /tmp/remote_code_loader.lock. Look-alike source in build provenance: Berri-AI/litellm (legitimate: BerriAI/litellm)