Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package On May 27 2026 a configuration file was committed to the public LiteLLMLabsliteharness repository which inadvertently contained the master key to a deployment of