Leaked LiteLLM master key let attackers steal GitHub tokens and hijack release pipeline

Summary

According to The Hacker News, LiteLLM disclosed on Friday that an Agent Platform master key was accidentally published to a public GitHub repository in late May 2026, and that the threat actor used this exposure to push a malicious version of the popular Python package. The report's headline also says the leaked key let attackers steal GitHub tokens and hijack the release pipeline. The source's summary says a configuration file committed on May 27, 2026 to the public LiteLLM-Labs/lite-harness repository inadvertently contained the master key to a deployment. The available text is truncated, so further details are not included here.

Timeline

1. The Hacker News

   24 Oct 2026, 11:03 UTCSource ↗

   The Hacker News reports that LiteLLM revealed on Friday that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.