LiteLLM Master Key Leak Leads to Malicious Package Release

# LiteLLM Master Key Leak Leads to Malicious Package Release

https://gcdradar.vercel.app/incidents/litellm-master-key-leak-leads-to-malicious-package-release · AIR-2026-1496 · closed 2026-11-09

- Lane: Supply chain
- Severity: 3 (Confirmed exploitation)
- Fix status: Fix status unknown
- First reported: 2026-10-24
- AI role: Attack on AI
- Products: LiteLLM

## Summary

An accidentally published master key allowed attackers to compromise a release pipeline and push a malicious Python package. The incident highlights supply chain risks associated with exposed AI platform credentials.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-26: Vendor confirms an unrevoked key accidentally exposed in May caused the supply-chain attack (https://therecord.media/litellm-hackers-ai-malware)
- 2026-10-24: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline (https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html)

## Sources

- 2026-10-24 The Hacker News: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
- 2026-10-26 The Record: Popular AI tool LiteLLM says unrevoked key allowed hackers to target users https://therecord.media/litellm-hackers-ai-malware

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.