[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRjhJaYH9CLQubZmtXGJAvNvPyfR3jPvr2AT1sf_R2dY":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d2c3f5a4-16a1-4d2f-99a2-710f5f74a392","Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline","leaked-litellm-master-key-let-attackers-steal-github-tokens-and-hijack-release-p-c2f353","LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. \"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs\u002Flite-harness repository which inadvertently contained the master key to a deployment of","An accidental leak of a LiteLLM Agent Platform master key on GitHub in May 2026 enabled a threat actor to steal GitHub tokens. The attacker used these tokens to hijack the release pipeline, pushing a malicious version of the LiteLLM package to PyPI, Docker Hub, and GHCR on October 21, 2026. The compromised tokens granted owner-level access to the GitHub organization, allowing for further credential exfiltration.","Leaked LiteLLM master key allowed attackers to steal GitHub tokens and hijack release pipeline.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fleaked-litellm-master-key-let-attackers.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEipiDo2Yur6TXZHLped9EQgORAH65rC4APGTaq_EZzlDnspAaULTQCKblBC0FeIah7nOCKTiQa2Oi8cyx-bbxHj042Km9oYAf2s78XmStFxzPBTSQ_oqv4ZcWGEkUP1wo5JfJ1UDrWQpAtz8ZHd9i3ZbGWWe8s6CMeUU_nObp5tCEywMWGovqFh9NA1H8Sv\u002Fs1600\u002Flite.jpg","2026-10-24T11:03:33+00:00","2026-10-24T12:00:07.073505+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":22},"Agent Platform","technology",{"name":24,"type":22},"GitHub CLI OAuth token",{"name":26,"type":19},"PyPI",{"name":28,"type":19},"Docker Hub",{"name":30,"type":19},"GHCR","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"ip","69.48.229.143","IP address used by the threat actor.",{"type":43,"value":60,"context":61},"LiteLLM version 1.107.0","Malicious version of the LiteLLM package published to PyPI.",[18,26,28],{"controls":64,"vendors":141},[65,93,119],{"slug":66,"name":67,"problem":68,"products":69},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[70,77,85],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":66,"product_name":74,"url":75,"description":76},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":94,"name":95,"problem":96,"products":97},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":115,"product_name":116,"url":117,"description":118},"idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":120,"name":121,"problem":122,"products":123},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[124,125,133],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"leaked-litellm-master-key-hijacks-pypi-release-pipeline-via-github-token-theft","Leaked LiteLLM Master Key Hijacks PyPI Release Pipeline via GitHub Token Theft","A master key accidentally committed to a public GitHub repository in May 2026 gave a threat actor the foothold needed to steal GitHub tokens with owner-level privileges. Those tokens were then used to inject a malicious package into the LiteLLM release pipeline, distributing compromised software to PyPI, Docker Hub, and GHCR — three of the most widely trusted package registries. This incident illustrates how a single exposed secret can cascade into a full software supply chain compromise, putting every downstream user of the package at risk. The months-long gap between the initial leak and the malicious release underscores how long undetected credential exposure can silently enable an attacker.",[147,148,149,150,151,152,153],"CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":155,"MITRE ATT&CK T1566: Phishing":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"OWASP A06:2021 Vulnerable and Outdated Components":158,"CIS Control 14: Security Awareness and Skills Training":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"NIS2 requires entities to implement controls for incident handling and supply chain security; the absence of controls to detect and respond to a leaked secret enabling pipeline hijacking directly violates this obligation.","While not phishing in the traditional sense, the attacker's use of a stolen valid credential to move laterally and exfiltrate further tokens mirrors credential-abuse techniques tracked under initial access and lateral movement in the ATT&CK framework, highlighting the need for behavioral monitoring of privileged token usage.","A robust secret management and remediation process — including immediate revocation upon detection — would have closed the exposure window before the attacker could weaponize the leaked key months later.","End users who installed the trojaned LiteLLM package from PyPI unknowingly consumed a compromised component, demonstrating the critical importance of verifying component integrity and provenance before use.","Developers were not adequately trained to recognize the risk of committing master keys and sensitive credentials to version control, a behavior that security awareness training and secure coding education directly address.","The accidental secret exposure represents an unmanaged vulnerability in the development lifecycle; a formal process for identifying and remediating such exposures would have triggered rapid revocation and pipeline audit.","The compromised master key granted owner-level access across the GitHub organization; enforcing least-privilege access and scoped tokens would have limited the blast radius of the credential leak."]