Seey retweeted
今天发生了一件让所有 AI 开发者后背发凉的事。
litellm,那个统一调用各家大模型 API 的 Python 库,GitHub 4 万星,月下载 9500 万次——被投毒了。
一行 pip install,你的 SSH 密钥、AWS/GCP/Azure 凭证、K8s Secrets、数据库密码、加密货币钱包、所有 .env 里的 API Key,全部被 AES-256 加密打包,POST 到攻击者的仿冒域名 models.litellm.cloud。如果检测到 K8s 环境,还会在每个节点部署特权 Pod 横向扩散。
最恐怖的是触发方式。攻击者在包里塞了一个 34KB 的 litellm_init.pth 文件。Python 的 .pth 是路径配置文件,由 site 模块在解释器启动时自动处理——如果某行以 import 开头,直接执行。攻击者利用这个机制写了一行:
import os, subprocess, sys; subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode('...'))"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
不需要你 import litellm,不需要你调用任何函数。你跑 pip、跑 python -c、IDE 启动语言服务器,甚至 pytest 跑测试——只要 Python 解释器启动,恶意代码就执行。装上就中招,完全静默。
载荷是三层 base64 嵌套:第一层 .pth 启动子进程;第二层是编排器,内嵌攻击者的 4096 位 RSA 公钥;第三层是凭证收割器,系统性搜刮 /home、/opt、/srv、/var/www、/app、/data、/tmp 下所有敏感文件。收集完毕后用 openssl 生成随机 32 字节 AES 会话密钥加密数据,再用 RSA-OAEP 加密会话密钥,打包为 tpcp.tar.gz 外传。
收割器之外还有持久化后门:在 ~/.config/sysmon/sysmon.py 注册为 systemd 用户服务,每 50 分钟轮询 checkmarx.zone 获取新指令,下载到 /tmp/pglog 执行。启动有 5 分钟延迟来躲避沙箱分析。即使你卸载了 litellm,后门仍然存活。
而且 pip install --require-hashes 也拦不住——恶意文件正常列入 wheel 的 RECORD,哈希完全匹配,因为包本身就是用被盗的合法 PyPI 令牌发布的。
你可能从没手动装过 litellm,但 DSPy、MLflow、Open Interpreter 等 2000 多个包都把它当依赖。Mandiant 确认已有 1000+ SaaS 环境感染,预计扩展到 10,000。
而这次攻击差点完美得逞——唯一的破绽是攻击者自己代码有 bug。.pth 通过 subprocess.Popen 启动子进程,子进程初始化时 site 模块又扫描到同一个 .pth,再次触发,指数级递归形成 fork bomb,撑爆了一个 Cursor 用户的内存才被发现。Karpathy 说:如果攻击者代码写得再好一点,这件事可能几周都不会被发现。
更荒诞的是攻击链的起点:安全扫描工具 Trivy 在 3/19 先被攻陷,攻击组织 TeamPCP 用它窃取了 litellm 的 PyPI 发布令牌,3/24 直接往 PyPI 推送带毒版本。用来保护你的工具,变成了攻击你的入口。社区在 GitHub 提 issue 报告后,攻击者 102 秒内用 73 个被盗账号发了 88 条垃圾评论淹没讨论,然后用被盗的维护者账号关闭了 issue。
自查脚本(覆盖版本检查、.pth 搜索、后门检测、可疑连接、K8s 扫描): gist.github.com/sorrycc/30a7…
安全版本:litellm==1.82.6。装了 1.82.7 或 1.82.8 的,假设所有凭证已泄露,立即轮换。
Seey retweeted
i changed all our "loading..." states to "thinking.."
we are an agentic AI startup now
Seey retweeted
Fusion of 𝗥𝗔𝗚 (Retrieval Augmented Generation) and 𝗖𝗔𝗚 (Cache Augmented Generation). You must understand fundamentals behind this architecture to save costs and reduce your system latency efficiently. So how can you benefit from it as AI Engineer?
Let’s see what it looks like and what additional considerations should be taken into account.
Here are example steps to implement CAG + RAG architecture:
𝘋𝘢𝘵𝘢 𝘗𝘳𝘦𝘱𝘳𝘰𝘤𝘦𝘴𝘴𝘪𝘯𝘨:
𝟭. We use only rarely changing data sources for Cache Augmented Generation. On top of the requirement of data changing rarely we should also think about which of the sources are often hit by relevant queries. Once we have this information, only then we pre-compute all of this selected data into a KV Cache of the LLM. Cache it in memory. This only needs to be done once, the following steps can be run multiple times without recomputing the initial cache.
𝟮. For RAG, if necessary, precompute and store vector embeddings in a compatible database to be searched later in step 4. Sometimes simpler data types are enough for RAG, a regular database might suffice.
𝘘𝘶𝘦𝘳𝘺 𝘗𝘢𝘵𝘩:
We can now utilise the preprocessed data.
𝟯. Compose a prompt including user query and the system prompt with instructions on how cached context and retrieved external context should be used by the LLM.
𝟰. Embed a user query to be used for semantic search via vector DBs and query the context store to retrieve relevant data. If semantic search is not required, query other sources, like real time databases or web.
𝟱. Enrich the final prompt with external context retrieved in step 4.
𝟲. Return the final answer to the user.
𝘚𝘰𝘮𝘦 𝘊𝘰𝘯𝘴𝘪𝘥𝘦𝘳𝘢𝘵𝘪𝘰𝘯𝘴:
➡️ Context window is not infinite and even while some models boast enormous context window sizes, the needle in the haystack problem has not yet been solved so use available context wisely and cache only the data you really need.
✅ For some business cases, specific datasets are extremely valuable to be passed to the model as cache. Think about an assistant that has to always comply with a lengthy set of internal rules stored in multiple documents.
✅ While CAG has been popularised for Open Source just recently, it is already viable for some time via Prompt Caching features in OpenAI and Anthropic APIs. It is really easy to start prototyping there.
✅ You should always separate hot and cold data sources, only use cold (data that changes rarely) in your cache, otherwise the data will go stale and the application will go out of sync.
❌ Be very careful about what you cache as the data will be available for all users to query.
❌ It is very hard to ensure RBAC for cached data unless you have a separate model with its own cache per role.
Have you used the combination already?





