Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
Summary
LiteLLM disclosed that a master key accidentally leaked in a public GitHub repository allowed a threat actor to steal GitHub tokens and inject a malicious version of their Python package. The attacker subsequently used these compromised credentials to push a compromised release, impacting the integrity of the LiteLLM project.
IFF Assessment
The compromise of a master key leading to the hijacking of a release pipeline and the injection of malicious code is a significant security failure that benefits attackers.
Defender Context
This incident highlights the critical importance of secure credential management and avoiding the accidental exposure of sensitive keys in public repositories. Defenders should be vigilant about supply chain security, scrutinizing package integrity and monitoring for signs of compromise in their CI/CD pipelines, especially for open-source dependencies.