🔴 更新完 PHP 先别睡！LiteLLM 又被骇，用户数据又可能泄漏。
受影响版本是 1.107.0。 PyPI 已经撤包。
- twitter.com/SocketSecurity/~- gh:BerriAI/litellm#47826- safedep.io/~
thread: /4832
#Security #LiteLLM #SupplyChain
Telegram 原文
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.Kunal Singh (SafeDep - Real-time Open Source Software Supply Chain Security)
