The LiteLLM project experienced a supply chain attack after a master key for its Agent Platform was accidentally published to a public GitHub repository. This compromise allowed threat actors to push a malicious version of the popular Python package, LiteLLM 1.107.0, to PyPI and Docker Hub. The malicious package contained a credential stealer and a backdoor, highlighting the severe consequences of exposed secrets in development pipelines. Users are advised to rotate secrets and verify package integrity.