#GitHub Actions

LiteLLM explains its poisoned release: an unrevoked key, an owner-level token and a relaxed approval rule

LiteLLM traces its malicious 1.107.0 release to a key leaked in May and has listed the fixes it is making. Microsoft published hunting guidance. What to check and rotate.