Exposed LiteLLM key enabled PyPI supply-chain attack

A reported compromise used an unrevoked LiteLLM key to obtain a GitHub token and abuse workflows to publish a poisoned PyPI release. The malware reportedly sought cloud, developer, and LLM-provider secrets, making this a concrete warning about credential lifecycle and CI/CD controls in AI infrastructure; attribution claims require validation.