Litellm 1.82.7 and 1.82.8 on PyPI are compromised, do not update! (opens in new tab)

Covered by cncf.ioDiscussed on Hacker News, Hacker News, Lobsters, r/LocalLLaMA, r/Python, and r/programming

litellm version 1.82.8 on PyPI contains a malicious .pth file that harvests SSH keys, cloud credentials, and secrets on every Python startup, then attempts lateral movement across Kubernetes clusters.

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 1 article

cncf.io·

Covered in 1 article

Securing CI/CD for an open source project: Controlling who runs what