LiteLLM revealed a master key leak in May 2026 that allowed attackers to hijack GitHub tokens and publish a malicious version of their Python package. The incident highlights the risks of exposed credentials and the importance of key revocation.
TL;DR
- LiteLLM accidentally exposed a master key in a public GitHub repository, enabling attackers to hijack GitHub tokens.
- The attackers used the stolen tokens to publish a malicious version of the LiteLLM Python package.
- The incident underscores the importance of proper key management and revocation processes.
What happened
On May 27, 2026, LiteLLM accidentally published a configuration file containing the master key to their Agent Platform to a public GitHub repository. The key was not revoked promptly, allowing attackers to exploit it.
On October 10, 2026, the attackers used the unrevoked master key to gain access to the Agent Platform and extract a GitHub CLI OAuth token with owner-level access to all LiteLLM repositories.
Between October 10 and October 21, 2026, the attackers used the stolen token to override branch protection, alter the release pipeline, and publish a malicious version of the LiteLLM Python package (version 1.107.0) to PyPI, Docker Hub, and GHCR.
Why it matters
This incident highlights the critical importance of proper key management and revocation processes. A single exposed key can lead to a significant security breach, as demonstrated by this supply chain attack.
For developers and startups, this serves as a reminder to regularly audit and secure credentials, especially those with high-level access. Implementing least privilege principles and monitoring for unusual activity can help prevent such incidents.
Investors should consider the security posture of AI startups, as incidents like this can have significant reputational and financial consequences. Understanding a company's approach to security and incident response is crucial.
Key facts
- The master key was exposed on May 27, 2026, and not revoked promptly.
- Attackers gained access to the Agent Platform on October 10, 2026, using the unrevoked master key.
- The stolen GitHub token had owner-level access to all LiteLLM repositories.
- The malicious package version (1.107.0) was published on October 21, 2026.
- The attackers used the stolen token to override branch protection and alter the release pipeline.
- The malicious package contained a credential harvesting module and a Unix-oriented backdoor.
- LiteLLM is working to revoke all tokens associated with internal systems and vendor platforms.
Context
This incident is part of a broader trend of supply chain attacks targeting open-source projects. As AI startups increasingly rely on open-source tools, securing the software supply chain becomes paramount.
The use of GitHub tokens with high-level access is not uncommon, but this incident underscores the need for better practices around credential management and least privilege principles.
The AI industry must prioritize security to maintain trust and prevent incidents that could hinder innovation and adoption.