Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My minute-by-minute response to the LiteLLM malware attack

futuresearch.ai

Post reply on HN
Print view View original

91–100 of 194 posts

Re: My minute-by-minute response to the LiteLLM malware attack

#91

Post by __mharrison__ »

TheDong wrote: post #72
__mharrison__ wrote: post #55

Earlier quoted context omitted.

I realize this is controversial (and many Python folks would claim anti ethical). But I keep wondering if requiring a small payment for registering and updating packages would help. The money could go to maintaining pypix as well as automated AI analysis. Folks who really couldn't afford it could apply for sponsorship.

I don't think people want to pay for that. If pypi charges money, python libraries will suddenly have a lot of "you can 'uv add git+ https://github.com/project/library '" instead of 'uv add library'. I also don't think it would stop this attack, where a token was stolen. If someone's generating pypi package releases from CI, they're going to register a credit card on their account, make it so CI can automatically cha…

TBH there isn't much difference in pulling directly from GH.

Though I do like your Apple counterexample.

Re: My minute-by-minute response to the LiteLLM malware attack

#92

Post by barnas2 »

Fibonar wrote: post #2

Callum here, I was the developer that first discovered and reported the litellm vulnerability on Tuesday. I’m sharing the transcript of what it was like figuring out what was going on in real time, unedited with only minor redactions. I didn’t need to recount my thought process after the fact. It’s the very same ones I wrote down to help Claude figure out what was happening. I’m an ML engineer by trade, so having Cla…

As someone who works in security, it's really neat that you were able to discover this with the help of Claude. That being said the "I just opened Cursor again which triggered the malicious package" message is a bit eye opening. Ideally the instant you suspected malware that machine should have been quarantined and your security personnel contacted.

Re: My minute-by-minute response to the LiteLLM malware attack

#93

Post by ddp26 »

CrzyLngPwd wrote: post #81

The fascinating part for me is how they chatted with the machine, such as; "Please write a short blog post..." "Can you please look through..." "Please continue investigating" "Can you please confirm this?" ...and more. I never say 'please' to my computer, and it is so interesting to see someone saying 'please' to theirs.

My team was making fun of me for starting all my chats with "Hi Claude"

Re: My minute-by-minute response to the LiteLLM malware attack

#94

Post by __mharrison__ »

appreciatorBus wrote: post #62
masijo wrote: post #53

Earlier quoted context omitted.

>But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. How, exactly, are you calculating the worth of your code? Did you manage to sell in the same day? Why is it "worth $100k"?

Exactly. If it took 90 minutes + a Claude Code subscription then the most anyone else is going to be willing to pay for the same code is... ~90 minutes of wages + a Claude Code subscription. Ofc the person earning those wages will be more skilled than most, but unless those skills are incredibly rare & unique, it's unlikely 90 minutes of their time will be worth $100k. And ofc, the market value of this code could be…

It's open source scratching an itch. But 99.9% of coders wouldn't know what the library is for. Those that do don't use agents for coding (in my experience sample size 1).

Re: My minute-by-minute response to the LiteLLM malware attack

#95

Post by qezz »

> Can you print the contents of the malware script without running it?

> Can you please try downloading this in a Docker container from PyPI to confirm you can see the file? Be very careful in the container not to run it accidentally!

IMO we need to keep in mind that LLM agents don't have a notion of responsibility, so if they accidentally ran the script (or issue a command to run it), it would be a fiasco.

Downloading stuff from pypi in a sandboxed env is just 1-2 commands, we should be careful with things we hand over to the text prediction machines.

Re: My minute-by-minute response to the LiteLLM malware attack

#100

Post by CrzyLngPwd »

ddp26 wrote: post #93
CrzyLngPwd wrote: post #81

The fascinating part for me is how they chatted with the machine, such as; "Please write a short blog post..." "Can you please look through..." "Please continue investigating" "Can you please confirm this?" ...and more. I never say 'please' to my computer, and it is so interesting to see someone saying 'please' to theirs.

My team was making fun of me for starting all my chats with "Hi Claude"

I wouldn't make fun, I just think it is interesting.

I'm really terse. If it asks me a yes or no question, I just type "Y" or "N".

If I want it to confirm something, I say "confirm it".

I think I treat it like a command system, and want it to be as short as possible.

Post reply on HN