LiteLLM Master Key Leak Leads to Malicious Package Injection and GitHub Token Theft

LiteLLM has confirmed a significant security incident involving the exposure of a master key that allowed attackers to hijack the project’s release pipeline and distribute a malicious version of its popular Python package.

The breach stemmed from a configuration file inadvertently committed to the public LiteLLM-Labs/lite-harness repository on 27 May 2026. This file contained a master key for a deployment of the LiteLLM Agent Platform, providing the threat actor with administrative-level access.

GitHub Tokens and Pipeline Compromise

By leveraging the exposed master key, the attacker was able to exfiltrate GitHub tokens. These credentials granted the necessary permissions to alter the project’s codebase and push an unauthorised, malicious update to the LiteLLM package, which is widely used for simplifying large language model (LLM) API integrations.

LiteLLM, which provides a standardised interface for various AI models, revealed that the compromise effectively turned a local configuration error into a supply chain risk for users of the library. The vulnerability of the release pipeline meant that the malicious code could have been distributed to any developer or organisation updating the package during the period of compromise.

Response and Mitigation

Upon discovering the exposure, LiteLLM revoked the compromised master key and rotated all associated secrets and GitHub tokens. The organisation has since implemented more stringent secret-scanning protocols to prevent sensitive credentials from being committed to public repositories in the future.

Users of the LiteLLM Python package are advised to ensure they are running the latest verified versions and to audit their own environments for any signs of unauthorised access if they utilised the affected platform during the window of exposure. Developers often use the LiteLLM library to manage multiple AI model providers, making the security of its distribution pipeline critical for AI application safety.

The incident highlights the persistent risks associated with “secret sprawl” and the importance of automated secret detection within continuous integration and continuous deployment (CI/CD) workflows. LiteLLM has stated it is taking steps to harden its infrastructure to prevent a recurrence of such an oversight.