Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

github.com

Post reply on HN
Print view View original

291–300 of 569 posts

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#291

Post by franktankbank »

Imustaskforhelp wrote: post #281
chunky1994 wrote: post #272

Earlier quoted context omitted.

Their Personal Access Token must’ve been pwned too, not sure through what mechanism though

They have written about it on github to my question: Trivvy hacked ( https://www.aquasec.com/blog/trivy-supply-chain-attack-what-... ) -> all circleci credentials leaked -> included pypi publish token + github pat -> | WE DISCOVER ISSUE | -> pypi token deleted, github pat deleted + account removed from org access, trivvy pinned to last known safe version (v0.69.3) What we're doing now: Block all releases, until we ha…

Does that explain how circleci was publishing commits and closing issues?

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#293

Post by celticninja »

Imustaskforhelp wrote: post #281
chunky1994 wrote: post #272

Earlier quoted context omitted.

Their Personal Access Token must’ve been pwned too, not sure through what mechanism though

They have written about it on github to my question: Trivvy hacked ( https://www.aquasec.com/blog/trivy-supply-chain-attack-what-... ) -> all circleci credentials leaked -> included pypi publish token + github pat -> | WE DISCOVER ISSUE | -> pypi token deleted, github pat deleted + account removed from org access, trivvy pinned to last known safe version (v0.69.3) What we're doing now: Block all releases, until we ha…

69.3 isnt safe. The safe thing to do is remove all trivy access. or failing that version. 0.35 is the last and AFAIK only safe version.

https://socket.dev/blog/trivy-under-attack-again-github-acti...

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#294

Post by fsflover »

binsquare wrote: post #109
jFriedensreich wrote: post #86

We just can't trust dependencies and dev setups. I wanted to say "anymore" but we never could. Dev containers were never good enough, too clumsy and too little isolation. We need to start working in full sandboxes with defence in depth that have real guardrails and UIs like vm isolation + container primitives and allow lists, egress filters, seccomp, gvisor and more but with much better usability. Its the same requir…

So... I'm working on an open source technology to make a literal virtual machine shippable i.e. freezing everything inside it, isolated due to vm/hypervisor for sandboxing, with support for containers too since it's a real linux vm. The problems you mentioned resonated a lot with me and why I'm building it, any interest in working to solve that together?: https://github.com/smol-machines/smolvm

It looks like you may be interested in Qubes OS, https://qubes-os.org.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#295

Post by Havoc »

shay_ker wrote: post #58

A general question - how do frontier AI companies handle scenarios like this in their training data? If they train their models naively, then training data injection seems very possible and could make models silently pwn people. Do the labs label code versions with an associated CVE to label them as compromised (telling the model what NOT to do)? Do they do adversarial RL environments to teach what's good/bad? I'm ve…

By betting that it dilutes away and not worrying about it too much. Bit like dropping radioactive barrels into the deep ocean.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#296

Post by kingreflex »

detente18 wrote: post #99

LiteLLM maintainer here, this is still an evolving situation, but here's what we know so far: 1. Looks like this originated from the trivvy used in our ci/cd - https://github.com/search?q=repo%3ABerriAI%2Flitellm%20trivy... https://ramimac.me/trivy-teampcp/#phase-09 2. If you're on the proxy docker, you were not impacted. We pin our versions in the requirements.txt 3. The package is in quarantine on pypi - this block…

we're using litellm via helm charts with tags main-v1.81.12-stable.2 and main-v1.80.8-stable.1 - assuming they're safe?

also how are we sure that docker images aren't affected?

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#297

Post by aborsy »

What is the best way to sandbox LLMs and packages in general, while being able to work on data from outside sandbox (get data in and out easily)?

There is also the need for data sanitation, because the attacker could distribute compromised files through user’s data which will later be run and compromise the host.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#298

Post by miraculixx »

jFriedensreich wrote: post #86

We just can't trust dependencies and dev setups. I wanted to say "anymore" but we never could. Dev containers were never good enough, too clumsy and too little isolation. We need to start working in full sandboxes with defence in depth that have real guardrails and UIs like vm isolation + container primitives and allow lists, egress filters, seccomp, gvisor and more but with much better usability. Its the same requir…

I agree in general, but how are you ever upgrading any of that? Could be a "sleeper compromise" that only activates sometime in the future. Open problem.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#299

Post by jFriedensreich »

miraculixx wrote: post #298
jFriedensreich wrote: post #86

We just can't trust dependencies and dev setups. I wanted to say "anymore" but we never could. Dev containers were never good enough, too clumsy and too little isolation. We need to start working in full sandboxes with defence in depth that have real guardrails and UIs like vm isolation + container primitives and allow lists, egress filters, seccomp, gvisor and more but with much better usability. Its the same requir…

I agree in general, but how are you ever upgrading any of that? Could be a "sleeper compromise" that only activates sometime in the future. Open problem.

A sleeper compromise that cannot execute can still not reach its goal. Generally speaking outdated dependencies without known compromise in a sandbox are still better than the latest deps with or without sandbox.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#300

Post by ratdoctor »

hiciu wrote: post #15

Besides main issue here, and the owners account being possibly compromised as well, there's like 170+ low quality spam comments in there. I would expect better spam detection system from GitHub. This is hardly acceptable.

Or they're just bots. This repository has 40k+ stars somehow.
Post reply on HN