LiteLLM has disclosed the initial access path behind the malicious 1.107.0 release. According to the report, an agent-platform master key accidentally committed to a public repository in May was removed from the file but not revoked. In October, the attacker used it to obtain an administrator’s GitHub token, then used two engineers’ tokens to initiate and approve a release separately. This adds a root-cause account to the previously confirmed compromise of distribution artifacts. It illustrates why removing an exposed file is not enough: credentials must be revoked and connected permissions examined.