Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM disclosed that a master key accidentally exposed in May 2026 enabled attackers to hijack their release pipeline and publish a malicious Python package version in October 2026. The breach involved stealing GitHub tokens with owner-level access, allowing extensive repository control and credential theft before detection and quarantine of the compromised package.