Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

github.com

Post reply on HN
Print view View original

81–90 of 569 posts

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#81

Post by worksonmine »

dec0dedab0de wrote: post #65

github, pypi, npm, homebrew, cpan, etc etc. should adopt a multi-multi-factor authentication approach for releases. Maybe have it kick in as a requirement after X amount of monthly downloads. Basically, have all releases require multi-factor auth from more than one person before they go live. A single person being compromised either technically, or by being hit on the head with a wrench, should not be able to release…

And how would that work for single maintainer projects?

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#82

Post by tom_alexander »

Only tangentially related: Is there some joke/meme I'm not aware of? The github comment thread is flooded with identical comments like "Thanks, that helped!", "Thanks for the tip!", and "This was the answer I was looking for."

Since they all seem positive, it doesn't seem like an attack but I thought the general etiquette for github issues was to use the emoji reactions to show support so the comment thread only contains substantive comments.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#84

Post by redrove »

xinayder wrote: post #61

When something like this happens, do security researchers instantly contact the hosting companies to suspend or block the domains used by the attackers?

First line of defense is the git host and artifact host scrape the malware clean (in this case GitHub and Pypi).

Domains might get added to a list for things like 1.1.1.2 but as you can imagine that has much smaller coverage, not everyone uses something like this in their DNS infra.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#85

Post by nickvec »

tom_alexander wrote: post #82

Only tangentially related: Is there some joke/meme I'm not aware of? The github comment thread is flooded with identical comments like "Thanks, that helped!", "Thanks for the tip!", and "This was the answer I was looking for." Since they all seem positive, it doesn't seem like an attack but I thought the general etiquette for github issues was to use the emoji reactions to show support so the comment thread only cont…

Ton of compromised accounts spamming the GH thread to prevent any substantive conversation from being had.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#86

Post by jFriedensreich »

We just can't trust dependencies and dev setups. I wanted to say "anymore" but we never could. Dev containers were never good enough, too clumsy and too little isolation. We need to start working in full sandboxes with defence in depth that have real guardrails and UIs like vm isolation + container primitives and allow lists, egress filters, seccomp, gvisor and more but with much better usability. Its the same requirements we have for agent runtimes, lets use this momentum to make our dev environments safer! In such an environment the container would crash, we see the violations, delete it and dont' have to worry about it. We should treat this as an everyday possibility not as an isolated security incident.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#87

Post by datadrivenangel »

shay_ker wrote: post #58

A general question - how do frontier AI companies handle scenarios like this in their training data? If they train their models naively, then training data injection seems very possible and could make models silently pwn people. Do the labs label code versions with an associated CVE to label them as compromised (telling the model what NOT to do)? Do they do adversarial RL environments to teach what's good/bad? I'm ve…

This was a compromise of the library owners github acccounts apparently, so this is not a related scenario to dangerous code in the training data.

I assume most labs don't do anything to deal with this, and just hope that it gets trained out because better code should be better rewarded in theory?

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#88

Post by incognito124 »

tom_alexander wrote: post #82

Only tangentially related: Is there some joke/meme I'm not aware of? The github comment thread is flooded with identical comments like "Thanks, that helped!", "Thanks for the tip!", and "This was the answer I was looking for." Since they all seem positive, it doesn't seem like an attack but I thought the general etiquette for github issues was to use the emoji reactions to show support so the comment thread only cont…

In the thread:

> It also seems that attacker is trying to stifle the discussion by spamming this with hundreds of comments. I recommend talking on hackernews if that might be the case.

Re: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

#90

Post by hmokiguess »

intothemild wrote: post #36

I just installed Harbor, and it instantly pegged my cpu.. i was lucky to see my processes before the system hard locked. Basically it forkbombed `grep -r rpcuser\rpcpassword` processes trying to find cryptowallets or something. I saw that they spawned from harness, and killed it. Got lucky, no backdoor installed here from what i could make out of the binary

What is Harness?
Post reply on HN