News for hackers. Stuff that matters.

A comment on LiteLLM Python package compromised by supply-chain attack. Parent comment

Re:LiteLLM Python package compromised by supply-chain attack by outside2344 on Tuesday March 24, 2026 @10:17AM (#47502968)
Is it just in 1.82.8 or are previous versions impacted?
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by Imustaskforhelp on Tuesday March 24, 2026 @10:18AM (#47502986)
1.82.7 is also impacted if I remember correctly.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by GrayShade on Tuesday March 24, 2026 @11:18AM (#47503957)
1.82.7 doesn't have litellm_init.pth in the archive. You can download them from pypi to check.

EDIT: no, it's compromised, see proxy/proxy_server.py.

[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by cpburns2009 on Tuesday March 24, 2026 @11:20AM (#47503978)
1.82.7 has the payload in `litellm/proxy/proxy_server.py` which executes on import.
[ Parent | on HN ]