Leaked LiteLLM Master Key Hijacks PyPI Release Pipeline via GitHub Token Theft
A master key accidentally committed to a public GitHub repository in May 2026 gave a threat actor the foothold needed to steal GitHub tokens with owner-level privileges. Those tokens were then used to inject a malicious package into the LiteLLM release pipeline, distributing compromised software to PyPI, Docker Hub, and GHCR — three of the most widely trusted package registries. This incident illustrates how a single exposed secret can cascade into a full software supply chain compromise, putting every downstream user of the package at risk. The months-long gap between the initial leak and the malicious release underscores how long undetected credential exposure can silently enable an attacker.
Tactical Insight
Immediate actions
- Rotate all exposed secrets and tokens immediately upon discovery of any accidental credential commit, and audit all actions taken using those credentials during the exposure window.
- Scan the entire repository history using secret-scanning tools (e.g., GitHub Advanced Security, truffleHog) to identify and revoke any other leaked credentials.
Long-term improvements
- Enforce pre-commit hooks and CI/CD pipeline secret-scanning checks to block secrets from ever reaching version control.
- Apply least-privilege principles to all CI/CD pipeline tokens so that no single credential grants owner-level access to an entire GitHub organization.
- Implement signed releases and provenance attestation (e.g., Sigstore/SLSA) for all packages published to PyPI, Docker Hub, and container registries so consumers can verify authenticity.
Detection measures
- Enable real-time alerting on GitHub secret scanning and configure automatic token revocation upon detection of a leaked credential.
- Monitor package registry publish events and pipeline activity for anomalous releases, triggering human review before packages reach end users.