Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

A master key for LiteLLM's Agent Platform was accidentally published to a public GitHub repository in late May 2026. This leak allowed attackers to steal GitHub tokens and hijack the release pipeline, enabling them to push a malicious version of a popular Python package. The key was exposed when a configuration file was committed to the LiteLLM-Labs/lite-harness repository on May 27, 2026, inadvertently containing the master key for a deployment. The leak was revealed by LiteLLM on Friday. The exposed key gave attackers access to sensitive information and control over the release pipeline. The incident occurred due to the accidental publication of a sensitive configuration file.