Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

On May 27, 2026, a configuration file containing the master key to a LiteLLM Agent Platform deployment was accidentally committed to the public LiteLLM-Labs/lite-harness GitHub repository. A threat actor discovered the leaked master key and leveraged it to steal GitHub tokens. With access to these tokens, the attacker was able to push a malicious version of the LiteLLM Python package, effectively hijacking the release pipeline. This represents a serious supply chain attack affecting users of the popular LiteLLM library. The incident highlights the dangers of accidentally exposing secrets in public repositories. LiteLLM disclosed the breach on a Friday in October 2026, weeks after the initial exposure in late May 2026.