LiteLLM traces supply chain attack to exposed GitHub key

LiteLLM: LiteLLM is an open-source Python library that provides a unified interface for developers to interact with multiple large language model providers through a consistent API. It supports proxy deployments and integrates with various LLM services for simplified model access and management. The project was the target of a supply chain attack in which an unrevoked master key, exposed on GitHub earlier in the year, enabled attackers to compromise its release pipeline and publish malicious versions of the package. Supply Chain Risks: Open source projects continue to face supply chain compromises through stolen credentials and manipulated CI/CD workflows, as seen in multiple incidents targeting developer tools and libraries in recent weeks. Credential Exposure: Unrevoked secrets committed to public repositories remain a persistent vulnerability, allowing prolonged access for attackers who later leverage them against project infrastructure and release processes.