Top StoriesBrief
LiteLLM leaked master key enables credential theft and malicious supply chain attack
An exposed master key allowed an unknown attacker to steal GitHub tokens and publish a compromised version of the LiteLLM Python package.
FTMQ Security, written by our newsroom0 views
LiteLLM revealed on October 24, 2026, that an unrevoked master key allowed an attacker to push a malicious update to its Python package, as reported by The Hacker News. An Agent Platform master key was accidentally published to a public GitHub repository in late May 2026. Although developers force-pushed over the commit, they failed to revoke the exposed master key. [1][2]
The Hacker News reported that an unknown attacker using the IP address 69.48.229.143 used the unrevoked master key on October 10, 2026. The attacker gained access to steal GitHub tokens and hijack the LiteLLM release pipeline. [1]
The compromised LiteLLM release on PyPI contained code that steals credentials and installs a backdoor on affected systems, according to The Hacker News. [1]
In short
- LiteLLM accidentally exposed an Agent Platform master key in May 2026.
- The exposed master key remained unrevoked despite the commit being force-pushed.
- An attacker used the key on October 10, 2026, to steal GitHub tokens and publish a malicious PyPI package.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release PipelineThe Hacker News, 14h ago (the report this story comes from)
- [2]Leaked LiteLLM Master Key Lets Attackers Hijack Release Pipeline, Publish Malicious Packagenews.lavx.hu, 12h ago
Background
- [3]Google Gemini on Wikipedia
- [4]Npm on Wikipedia
- [5]List of aircraft hijackings on Wikipedia
Our newsroom writes these reports with the help of software, from the 5 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Rank Math PRO WordPress plugin compromised in supply chain attackTop Stories, 5d ago
- Meta suffers GitHub breach exposing corporate code and employee dataTop Stories, 11d ago
- OpenAI skill repository contains hallucinated domain vulnerability affecting Render app tokensTop Stories, 8d ago
- Zeabur shuts down following massive breach of user data and credentialsTop Stories, 4d ago
- P7 DarkSword iOS exploit kit steals crypto wallet data and commands devicesTop Stories, 13d ago
More in Top Stories
- Oracle fixes 1295 vulnerabilities including six maximum severity flaws1d ago
- Microsoft Teams to add artificial intelligence phishing detection in November1d ago
- BlackX UEFI bootkit targets Central Asian diplomatic entities to bypass Secure Boot1d ago
- Capcom confirms data breach exposing eleven point seven million accounts2d ago
- GitLab issues security updates for critical unauthenticated code execution vulnerability2d ago
- China aligned group Storm 0940 uses AI tool in ConnectWise breach2d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.