软件恐怖：litellm PyPI供应链攻击。简单的`pip install litellm`就足以窃取SSH密钥、AWS/GCP/Azure凭证、Kubernetes配置...

相关报道

• Telnyx, LiteLLM and Axios: the supply chain crisis

  7.5

  A series of supply chain attacks has affected npm and PyPI repositories within two weeks. The use of large language models is exacerbating these security issues, and existing mitigation measures are insufficient to address the problem.

• ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

  7.5

  A new phishing-as-a-service called Starkiller uses disguised links to load real login pages from target brands. It acts as a relay between victims and legitimate sites, forwarding usernames, passwords, and MFA codes to bypass security measures.

• Here’s how I got full admin rights in a Replit clone

  6.5

  A security researcher discovered a vulnerability that allowed obtaining full administrator rights in a Replit clone. The vulnerability stemmed from running untrusted code in an insecure manner. This highlights the importance of proper security practices when executing external code.

• LLM Use in the Python Source Code

  6.5

  A social media trick shows that blocking the "claude" user on GitHub reveals projects using Claude Code. The CPython repository, one of the world's most popular open-source projects, now displays contributions from this AI coding agent.

• Scam Telegram: Uncovering a network of groups spreading crypto drainers

  4.5

  An investigation uncovered a large network of fake support groups on Telegram that spread cryptocurrency stealers and drainers. The network was found to be actively promoting malicious tools designed to drain crypto wallets.