Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
Leaked LiteLLM master key allowed attackers to steal GitHub tokens and hijack release pipeline.
Run LiteLLM?
Get an email when a reviewed story names LiteLLM, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
An accidental leak of a LiteLLM Agent Platform master key on GitHub in May 2026 enabled a threat actor to steal GitHub tokens. The attacker used these tokens to hijack the release pipeline, pushing a malicious version of the LiteLLM package to PyPI, Docker Hub, and GHCR on October 21, 2026. The compromised tokens granted owner-level access to the GitHub organization, allowing for further credential exfiltration.
The lesson from this incident
Full lessonA master key accidentally committed to a public GitHub repository in May 2026 gave a threat actor the foothold needed to steal GitHub tokens with owner-level privileges. Those tokens were then used to inject a malicious package into the LiteLLM release pipeline, distributing compromised software to PyPI, Docker Hub, and GHCR — three of the most widely trusted package registries. This incident illustrates how a single exposed secret can cascade into a full software supply chain compromise, putting every downstream user of the package at risk. The months-long gap between the initial leak and the malicious release underscores how long undetected credential exposure can silently enable an attacker.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- ip — 69.48.229.143
- malware — LiteLLM version 1.107.0