Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My minute-by-minute response to the LiteLLM malware attack

futuresearch.ai

Post reply on HN
Print view View original

61–70 of 194 posts

Re: My minute-by-minute response to the LiteLLM malware attack

#61

Post by __mharrison__ »

masijo wrote: post #53
__mharrison__ wrote: post #51

Interesting world we live in. I just finished teaching an advanced data science course for one of my clients. I found my self constantly twitching everytime I said "when I write code..." I'm barely writing code at all these days. But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. Tested and uploaded to pypi in 90 minutes. A lot of the conversation in my course was d…

>But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. How, exactly, are you calculating the worth of your code? Did you manage to sell in the same day? Why is it "worth $100k"?

sloccount

Re: My minute-by-minute response to the LiteLLM malware attack

#62

Post by appreciatorBus »

masijo wrote: post #53
__mharrison__ wrote: post #51

Interesting world we live in. I just finished teaching an advanced data science course for one of my clients. I found my self constantly twitching everytime I said "when I write code..." I'm barely writing code at all these days. But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. Tested and uploaded to pypi in 90 minutes. A lot of the conversation in my course was d…

>But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. How, exactly, are you calculating the worth of your code? Did you manage to sell in the same day? Why is it "worth $100k"?

Exactly.

If it took 90 minutes + a Claude Code subscription then the most anyone else is going to be willing to pay for the same code is... ~90 minutes of wages + a Claude Code subscription.

Ofc the person earning those wages will be more skilled than most, but unless those skills are incredibly rare & unique, it's unlikely 90 minutes of their time will be worth $100k.

And ofc, the market value of this code could be higher, even much higher, the the cost to produce it, but for this to be the case, there needs to be some sort of moat, some sort of reason another similarly skilled person cannot just use Claude to whip up something similar in their 90 minutes.

Re: My minute-by-minute response to the LiteLLM malware attack

#63

Post by __mharrison__ »

pxtail wrote: post #56
__mharrison__ wrote: post #51

Interesting world we live in. I just finished teaching an advanced data science course for one of my clients. I found my self constantly twitching everytime I said "when I write code..." I'm barely writing code at all these days. But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. Tested and uploaded to pypi in 90 minutes. A lot of the conversation in my course was d…

Only $100k worth code? Rookie numbers, you must be new to the game

Doing my part to burn $50k tokens in a year as per the Jensen mandate.

Re: My minute-by-minute response to the LiteLLM malware attack

#64

Post by Fibonar »

Shank wrote: post #39

Probably one of the best things about AI/LLMs is the democratization of reverse engineering and analysis of payloads like this. It’s a very esoteric skill to learn by hand and not very immediately rewarding out of intellectual curiosity most times. You can definitely get pointed in the right direction easily, now, though!

I’ve entertained myself with CTF walkthroughs on YouTube before and had been meaning to try it out. But yeah I feel it falls under the same category as lock picking, fun to LARP, unlikely to stumble across in my day job.

Re: My minute-by-minute response to the LiteLLM malware attack

#65

Post by darkstarsys »

RALaBarge wrote: post #47
S0y wrote: post #26

> Where did the litellm files come from? Do you know which env? Are there reports of this online? > The litellm_init.pth IS in the official package manifest — the RECORD file lists it with a sha256 hash. This means it was shipped as part of the litellm==1.82.8 wheel on PyPI, not injected locally. > The infection chain: > Cursor → futuresearch-mcp-legacy (v0.6.0) → litellm (v1.82.8) → litellm_init.pth This is the scar…

Maybe the people who use emacs for everything are the only safe ones?

straight and elpaca etc. are just as vulnerable. Maybe more so.

Re: My minute-by-minute response to the LiteLLM malware attack

#66

Post by ddp26 »

intothemild wrote: post #52
cdcarter wrote: post #50

If it weren't for the 11k process fork bomb, I wonder how much longer it would have taken for folks to notice and cut this off.

Thats the thing, i noticed it almost instantly when trying to install a package that depended on it, as soon as it started, it hard locked my laptop, didn't get to infect it.. but if they had slowed down that fork bomb.. it would have done more damage.

Yeah, and this is a pattern I saw in the Fancy Bear Goes Fishing book, a lot of discovery of malware is either pure luck, or blunders from the malware developers. https://en.wikipedia.org/wiki/Fancy_Bear_Goes_Phishing

Re: My minute-by-minute response to the LiteLLM malware attack

#67

Post by croemer »

__mharrison__ wrote: post #61
masijo wrote: post #53

Earlier quoted context omitted.

>But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. How, exactly, are you calculating the worth of your code? Did you manage to sell in the same day? Why is it "worth $100k"?

sloccount

So the more junk lines the more it's worth. Right.

Don't use bogus $ from sloccount. Just say I created a 10k line project.

Re: My minute-by-minute response to the LiteLLM malware attack

#68

Post by ddp26 »

simonw wrote: post #11

First time I've seen my https://github.com/simonw/claude-code-transcripts tool used to construct data that's embedded in a blog post, that's a neat way to use it. I usually share them as HTML pages in Gists instead, e.g. w https://gisthost.github.io/?effbdc564939b88fe5c6299387e217da...

Yeah, sharing information across Claude Code sessions really is a problem that needs solving. An urgent hack, where you're using Claude Code to debug and trying to get help from your team, is one such case.

Re: My minute-by-minute response to the LiteLLM malware attack

#69

Post by toomuchtodo »

simonw wrote: post #49
charcircuit wrote: post #40

Earlier quoted context omitted.

It is not effective if it just takes a simple base64 encode to bypass. If Claude is trivially able to find that it is malicious then Pypi is being negligent.

The package in question was live for 46 minutes. It generally takes longer than that for security partners to scan and flag packages. PyPI doesn't block package uploads awaiting security scanning - that would be a bad idea for a number of reasons, most notably (in my opinion) that it would be making promises that PyPI couldn't keep and lull people into a false sense of security.

Would you happen to know where the latency comes from between upload and scanning? Would more resources for more security scanner runners to consume the scanner queue faster solve this? Trying to understand if there are inherent process limitations or if a donation for this compute would solve this gap.

(software supply chain security is a component of my work)

Re: My minute-by-minute response to the LiteLLM malware attack

#70

Post by zar1048576 »

Fibonar wrote: post #2

Callum here, I was the developer that first discovered and reported the litellm vulnerability on Tuesday. I’m sharing the transcript of what it was like figuring out what was going on in real time, unedited with only minor redactions. I didn’t need to recount my thought process after the fact. It’s the very same ones I wrote down to help Claude figure out what was happening. I’m an ML engineer by trade, so having Cla…

Fantastic write-up and thanks for sharing! I'm sure we will continue to see more of these types of deep supply chain vulns. I think this is valuable for the security community. Remember that Cliff Stoll was an astrophysicist turned sysadmin for Lawrence Berkeley Labs who chased down a $0.75 accounting discrepancy to identify a foreign espionage operation.
Post reply on HN