LiteLLM Traces Malicious Release to Master Key Left Unrevoked

LiteLLM traced a malicious release to a master key exposed in May, linking it to stolen GitHub access and a redirected release pipeline in October. The key was never revoked, allowing attackers to compromise the software supply chain. Users are advised to rotate credentials and audit recent releases for tampering.