Looks like all of the LiteLLM CEO’s public repos have been updated with the description “teampcp owns BerriAI” https://github.com/krrishdholakia
Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
51–60 of 569 posts
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#52Does anyone know a good alternate project that works similarly (share multipple LLMs across a set of users)? LiteLLM has been getting worse and trying to get me to upgrade to a paid version. I also had issues with creating tokens for other users etc.
pydantic-ai
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#53That's a bad supply-chain attack, many folks use litellm as main gateway
laughs smugly in vimscript
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#54Does anyone know a good alternate project that works similarly (share multipple LLMs across a set of users)? LiteLLM has been getting worse and trying to get me to upgrade to a paid version. I also had issues with creating tokens for other users etc.
github.com/mozilla-ai/any-llm :)
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#55LiteLLM is the second worst software project known to man. (First is LangChain. Third is OpenClaw.)
I'm sensing a pattern here, hmm.
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#56This is a brutal one. A ton of people use litellm as their gateway.
Do you feel as if people will update litellm without looking at this discussion/maybe having it be automatic which would then lead to loss of crypto wallets/ especially AI Api keys? Now I am not worried about the Ai Api keys having much damage but I am thinking of one step further and I am not sure how many of these corporations follow privacy policy and so perhaps someone more experienced can tell me but wouldn't th…
Maybe then people will start to realize crypto isn't even worth the stored bits.
Irrevocable transfers... What could go wrong?
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#57[flagged]
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#58A general question - how do frontier AI companies handle scenarios like this in their training data? If they train their models naively, then training data injection seems very possible and could make models silently pwn people.
Do the labs label code versions with an associated CVE to label them as compromised (telling the model what NOT to do)? Do they do adversarial RL environments to teach what's good/bad? I'm very curious since it's inevitable some pwned code ends up as training data no matter what.
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#59We need real sandboxing. Out-of-process sandboxing, not in-process. The attacks are only going to get worse.
That's why I'm building https://github.com/kstenerud/yoloai
Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
#60LiteLLM is the second worst software project known to man. (First is LangChain. Third is OpenClaw.) I'm sensing a pattern here, hmm.
Not familiar with LangChain besides at a surface level - what makes it the worst software project known to man?