Since 2012 I've been hearing/watching security now as a spectator counting the points and learning along the way but totally passive.. until now.
Yesterday, LiteLLM a tool that I use and like has been compromised, This brought the news home in an unexpected way:
Researchers at Sonatype and Wiz discovered that two compromised versions of LiteLLM (1.82.7 and 1.82.8) had been uploaded directly to PyPI, bypassing the project's CI/CD pipeline. With 97 million monthly downloads and widespread use as a transitive dependency
The blast radius will be major.
As soon as i learned of the breach thanks to @fahdmirza video
I made a script (well Claude did the heavy lifting) to detect the presence of the compromised versions of LiteLLM on my PC and identify where it is used, I have subsequently extended the script to work on Windows.
The code can be found in GitHub: https://github.com/CognitiveSand/scan_litellm_compromise
Yours sincerely Jean-Michel
PS: I had a lot of fun listening to episode 1070 when Steve mention uncle Bob's issues to have AI behave (which is a major issue for every one), The irony here is that one of my secret sauce to have AI produce good code is to tell it to code like uncle Bob, and this works fantastically well.
PS2: Even-though the episodes on Vitamin D and Magnesium where not on subject these were extremely interesting
Yesterday, LiteLLM a tool that I use and like has been compromised, This brought the news home in an unexpected way:
Researchers at Sonatype and Wiz discovered that two compromised versions of LiteLLM (1.82.7 and 1.82.8) had been uploaded directly to PyPI, bypassing the project's CI/CD pipeline. With 97 million monthly downloads and widespread use as a transitive dependency
The blast radius will be major.
As soon as i learned of the breach thanks to @fahdmirza video
I made a script (well Claude did the heavy lifting) to detect the presence of the compromised versions of LiteLLM on my PC and identify where it is used, I have subsequently extended the script to work on Windows.
The code can be found in GitHub: https://github.com/CognitiveSand/scan_litellm_compromise
Yours sincerely Jean-Michel
PS: I had a lot of fun listening to episode 1070 when Steve mention uncle Bob's issues to have AI behave (which is a major issue for every one), The irony here is that one of my secret sauce to have AI produce good code is to tell it to code like uncle Bob, and this works fantastically well.
PS2: Even-though the episodes on Vitamin D and Magnesium where not on subject these were extremely interesting
Last edited: