An unrevoked LiteLLM master key enabled GitHub token theft and a malicious PyPI release that steals credentials and installs ...