Leaked LiteLLM Master Key Enables Malicious Package Push to PyPI

On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness GitHub repository. The file inadvertently contained a master key for a deployment of LiteLLM's Agent Platform. Following the accidental publication, a threat actor is reported to have used the exposed key to gain unauthorized access and push a malicious version of the Python package to the Python Package Index (PyPI). The incident highlights the risks associated with credential leakage in development workflows. LiteLLM disclosed the incident on October 24, 2026. The exact number of affected users, the specific malicious payload details, and the full extent of any GitHub token theft remain under investigation and require further verification from official advisories.