The corrected entry point is an AI agent orchestration service. A master key committed publicly on May 27 stayed valid after the commit was hidden by force-push. On October 10 the attacker used it to retrieve agent configurations, including a human GitHub organization owner's CLI OAuth token. That token had broad owner authority and was already past multi-factor authentication. The vendor's October 23 investigation supersedes the earlier hypothesis that model response logs supplied the first token.
The owner identity enabled two separate throwaway CI runs to export two maintainers' tokens. On October 21 the attacker changed the release workflow to consume a lookalike repository, after an initial protected push failed and an owner override succeeded. The observed release used one compromised identity to trigger the pipeline and another to approve it. The vendor explicitly notes that owner authority could also have removed those restrictions, so the two-person gate was not independent of the compromise.
The real pipeline signed and published the malicious wheels and containers. On an affected consumer, cook.pth in site-packages executed during Python startup, loading cook.py and collecting accessible credentials. Wiz's analysis also identifies sitecustomize.py, a credential-database query and an encrypted HTTP exfiltration path. The remote loader was dormant; it is not evidence of a later executed command. Platform-specific failures mean not every code branch worked on every operating system.
The canonical timeline places wheel publication around 11:40 UTC on October 21, PyPI freezing at 13:23 UTC and container removal at 14:20 UTC. Download estimates describe distribution, not confirmed victims. Credential checks and Bedrock model enumeration after the theft support an abuse investigation, but do not establish paid inference consumption. This October incident is separate from the earlier malicious LiteLLM 1.82.x releases.