Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

github.com

Post reply on HN
Print view View original

231–240 of 569 posts

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#231

Post by harekrishnarai »

detente18 wrote: post #99

LiteLLM maintainer here, this is still an evolving situation, but here's what we know so far: 1. Looks like this originated from the trivvy used in our ci/cd - https://github.com/search?q=repo%3ABerriAI%2Flitellm%20trivy... https://ramimac.me/trivy-teampcp/#phase-09 2. If you're on the proxy docker, you were not impacted. We pin our versions in the requirements.txt 3. The package is in quarantine on pypi - this block…

> it seems your personal account is also compromised. I just checked for the github search here https://github.com/search?q=%22teampcp+owns%22

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#232

Post by franktankbank »

redrove wrote: post #222
detente18 wrote: post #210

Earlier quoted context omitted.

It was the PYPI_PUBLISH token which was in our github project as an env var, that got sent to trivvy. We have deleted all our pypi publishing tokens. Our accounts had 2fa, so it's a bad token here. We're reviewing our accounts, to see how we can make it more secure (trusted publishing via jwt tokens, move to a different pypi account, etc.).

How did PYPI_PUBLISH lead to a full GH account takeover?

Don't hold your breath for an answer.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#235

Post by wheelerwj »

redrove wrote: post #102
detente18 wrote: post #99

LiteLLM maintainer here, this is still an evolving situation, but here's what we know so far: 1. Looks like this originated from the trivvy used in our ci/cd - https://github.com/search?q=repo%3ABerriAI%2Flitellm%20trivy... https://ramimac.me/trivy-teampcp/#phase-09 2. If you're on the proxy docker, you were not impacted. We pin our versions in the requirements.txt 3. The package is in quarantine on pypi - this block…

>1. Looks like this originated from the trivvy used in our ci/cd Were you not aware of this in the short time frame that it happened in? How come credentials were not rotated to mitigate the trivy compromise?

The latest trivy attack was announced just yesterday. If you go out to dinner or take a night off its totally plausible to have not seen it.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#236

Post by vintagedave »

detente18 wrote: post #99

LiteLLM maintainer here, this is still an evolving situation, but here's what we know so far: 1. Looks like this originated from the trivvy used in our ci/cd - https://github.com/search?q=repo%3ABerriAI%2Flitellm%20trivy... https://ramimac.me/trivy-teampcp/#phase-09 2. If you're on the proxy docker, you were not impacted. We pin our versions in the requirements.txt 3. The package is in quarantine on pypi - this block…

This must be super stressful for you, but I do want to note your "I'm sorry for this." It's really human.

It is so much better than, you know... "We regret any inconvenience and remain committed to recognising the importance of maintaining trust with our valued community and following the duration of the ongoing transient issue we will continue to drive alignment on a comprehensive remediation framework going forward."

Kudos to you. Stressful times, but I hope it helps to know that people are reading this appreciating the response.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#237

Post by swyx »

intothemild wrote: post #36

I just installed Harbor, and it instantly pegged my cpu.. i was lucky to see my processes before the system hard locked. Basically it forkbombed `grep -r rpcuser\rpcpassword` processes trying to find cryptowallets or something. I saw that they spawned from harness, and killed it. Got lucky, no backdoor installed here from what i could make out of the binary

> i was lucky to see my processes before the system hard locked.

how do you do that? have Activity Monitor up at all times?

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#238

Post by franktankbank »

wheelerwj wrote: post #235
redrove wrote: post #102

Earlier quoted context omitted.

>1. Looks like this originated from the trivvy used in our ci/cd Were you not aware of this in the short time frame that it happened in? How come credentials were not rotated to mitigate the trivy compromise?

The latest trivy attack was announced just yesterday. If you go out to dinner or take a night off its totally plausible to have not seen it.

[flagged]

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#239

Post by mark_l_watson »

Imustaskforhelp wrote: post #154
mark_l_watson wrote: post #148

A question from a non-python-security-expert: is committing uv.lock files for specific versions, and only infrequently updating versions a reasonable practice?

(I am not a security expert either) But, one of the arguments that I saw online from this was that when a security researcher finds a bug and reports it to the OSS project/Company they then fix the code silently and include it within the new version and after some time, they make the information public So if you run infrequently updated versions, then you run a risk of allowing hackers access as well. (An good exampl…

Good points. Perhaps there is a way to configure uv to only use a new version if it is 24 hours old?

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#240

Post by embedding-shape »

franktankbank wrote: post #238
wheelerwj wrote: post #235

Earlier quoted context omitted.

The latest trivy attack was announced just yesterday. If you go out to dinner or take a night off its totally plausible to have not seen it.

[flagged]

Probably more "serious human" than "serious over-capitalist" or "seriously overworked". Good for them.
Post reply on HN