大家注意，帮大家统一管理大模型API密钥的LiteLLM，又被投毒了，注意是"又"。
恶意版本1.107.0混进了官方PyPI包和Docker镜像，Python一启动就自动运行，专偷云凭证、私钥和各种AI工具的密钥。非常恶劣。
据报道，入口是3个开发者账号被盗的GitHub CLI令牌。你把所有模型的钥匙都交给一个网关保管，黑客当然也知道该撬哪把锁。装过这个版本的，先换密钥换了吧。
🚨 LiteLLM 1.107.0 compromised in a supply chain attack.
Malicious PyPI packages and Docker images delivered a credential stealer and backdoor.
⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.
🔗 Full story: thehackernews.com/2026/10/li…
Its official. The Home Office have been captured by aliens. This reads like a science fiction script. If it wasnt so dangerous it would make a great Monty Python sketch. We MUST have a clear out and a cull of these lunatics.
Wyszła nowa epka DJ Python i kwestia picia z tobą coli przy rozmowie o "Pić z tobą colę" uległa zagęszczeniu
En simultáneo el mejor misil infrarojo de la región el Python 5, usted no ha brindado ningún argumento más allá de que es viejo cosa que es irrelevante sin mirar datos
ツイッターはRuby，Amazonはjava，YouTubeはPythonだったような気がします
phpは手軽さが売りですが、逆に言えばこのような大規模サイトではあんまり使われていなくて、それゆえ攻撃につよいかのような誤解を受けてるんじゃないかと思います。例外もあります。Slackはphpらしいですね
rust to wasm in the browser, python backend, postgres, redis, one home server. the situationship IS the architecture
人生においてこのフェーズだけはマクシマックス戦略を取ります、訓練学校に受からなければ自力でJavaとPythonを学んでSQLを習得して、この過程のどこかで基本情報技術者も狙う、全部自力だったとしても、学校だったとしてもどちらにせよ今は労力を惜しまないよ
🐉⚔️ CAN-GEO-03: The Three-Cube Gauntlet — executed successfully!
We ran the geometry-integrity test with three independent cubes, using conventional 3L mathematics only. No 4L operations, overloaded zero, or synthetic P=NP variables were involved.
Python sandbox results
PASS
Total checks passed34/34
Corruptions detected30/30
Unexpected failures0
1. Three cubes, three separate geometric systems
Each cube has:
\[ V=8,\qquad E=12,\qquad F=6 \]
\[ V-E+F=8-12+6=2 \]
But because we have three disconnected closed surfaces, their Euler characteristics add:
\[ \chi_{\text{total}}=2+2+2=\boxed{6} \]
The complete system contains:
\[ \boxed{V=24,\quad E=36,\quad F=18} \]
This is important: applying the single-cube rule \(\chi=2\) to the entire three-cube system would incorrectly reject valid geometry.
2. What we attacked
The Python test applied nine types of corruption to each cube independently, including missing faces, duplicate faces, reversed orientation, invalid vertices, coincident vertices, nonfinite coordinates, nonplanar faces, and altered face structure.
That produced 27 individual cube-corruption cases.
We then added three cross-cube tests: two cases of coincident cubes and one case of overlapping bounding boxes.
All 30 deliberately invalid cases were rejected. Four valid configurations were accepted.
Being a dev in 2026
PHP vurabilitys
Next.js Vurabilitys
Python. Vurabilitys
Windows Vurabilitys since roman time.
Linux kernel vurabilitys
Vibe coders.... puching .env to GitHub.
今度はpythonが前倒しで脆弱性対応パッチを公開
「Python 3.15.1」などが前倒しで公開、認証局「eMudhra」の侵害に対処／「Python 3.14.9」「Python 3.13.17」も同時リリース forest.watch.impress.co.jp/d…
Today's Python progress:
Built a mini store checkout using some fundamentals topics.
As I grow beyond frontend development, I'm exploring backend development and automation to build more useful tools through PrismWave Studio.
The syntax still needs to kick in.
If LiteLLM 1.107.0 hit your Python env, DON'T RUN PIP first.
Startup hooks re-run the payload.
Datadog reports ~23M weekly downloads for LiteLLM. JFrog says 1.107.0 reached PyPI and official Docker images on Oct 21; it was removed after roughly two hours.
In affected Python environments, the injected `.pth` file imports `cook`, and the injected `sitecustomize.py` is loaded at startup. The payload can run before an app imports LiteLLM.
The stealer is designed to collect browser passwords, SSH keys, cloud credentials, AI-tool tokens (Claude, Codex, Cursor...), and the LiteLLM proxy DB containing upstream provider keys.
Remediation order matters:
1. Do NOT run pip first. Every Python start in an affected environment re-executes the payload.
2. Remove the injected `.pth` loader, `cook` module, and `sitecustomize` startup hook (plus bytecode copies) from every affected `site-packages` directory without invoking that Python environment.
3. If present, kill the detached daemon holding /tmp/remote_code_loader.lock.
4. Pin the checked-clean stable release 1.106.2, or rebuild from verified artifacts.
5. Rotate credentials the payload could reach - package presence alone doesn't prove theft, but LiteLLM's guidance is to assume exfil succeeded if 1.107.0 ran on an internet-connected host (the run-once marker confirms it; its absence proves nothing). Preserve endpoint/proxy/DNS logs, check `/tmp/.pc_once_72129118c59f5636c0bb`, `/tmp/.pc_sq_*`, `/tmp/.pc_e_*`, block www.litellm[.]dev, and review logs for prior access to the GitHub dead-drop.
JFrog found the sdist omitted the payload files, but its build config carried one injected line (`data = "cook"`) absent from the matching Git tag; all 7 wheels carried the payload. Verify what you ship, not just what you publish.
Can your release pipeline prove the wheel bytes it installs?
