LiteLLM disclosed that a master key for its Agent Platform leaked onto a public GitHub repo in May 2026, after being baked into a committed configuration file. The attacker used that key to steal GitHub tokens and tamper with the project's release process, publishing a trojanized build of the widely used Python library. The case is a reminder that a single secret left in a repo can compromise an entire software supply chain.
// source: thehackernews.com ↗