# Four Custodians of AI Provider Keys, Hit in Sixteen Days
# Optimus Labs · Civilizations — https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026
# Published: 2026-10-21 | Severity: critical
# Affected: Fireworks AI, OpenCode, LiteLLM, Railway, Anthropic, OpenAI, Google
#
# Machine-readable siblings:
#   STIX 2.1: https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026.stix.json
#   MISP event: https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026.misp.json
#   Markdown: https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026.md

## sha256
1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e

## file
cook.py
sitecustomize.py

## url
http://www.litellm.dev/healthcheck

## domain
raw.githubusercontent.com

## narrative-indicators
# Malicious package: litellm 1.107.0 (PyPI, all seven wheels). Last safe version 1.106.2.
# Docker tags on Oct 21: v1.107.0, latest, main-latest, main-stable (digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e)
# Files in site-packages: cook.pth, cook.py, sitecustomize.py
# Exfiltration: hxxp://www[.]litellm[.]dev/healthcheck. Dead drop: raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt
# Lock file /tmp/remote_code_loader.lock. Look-alike source in build provenance: Berri-AI/litellm (legitimate: BerriAI/litellm)