Telnyx、LiteLLM 与 Axios：供应链危机

相关报道

• Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes con...

  8.5

  A compromised version of the LiteLLM Python package (version 1.82.8) was briefly available on PyPI, capable of exfiltrating sensitive credentials like SSH keys and cloud secrets. The malicious package affected any project that depended on LiteLLM, though it was only available for about an hour before discovery.

• New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads. Scanning my system I found a use imp...

  8.5

  A supply chain attack has compromised the popular npm axios HTTP client library with 300 million weekly downloads. Malicious versions install a remote access trojan, though some users may have avoided infection through version pinning or older installations. Security experts warn this is a live compromise affecting one of npm's most depended-on packages.

• ‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

  7.5

  A new phishing-as-a-service called Starkiller uses disguised links to load real login pages from target brands. It acts as a relay between victims and legitimate sites, forwarding usernames, passwords, and MFA codes to bypass security measures.

• Here’s how I got full admin rights in a Replit clone

  6.5

  A security researcher discovered a vulnerability that allowed obtaining full administrator rights in a Replit clone. The vulnerability stemmed from running untrusted code in an insecure manner. This highlights the importance of proper security practices when executing external code.

• LLM Use in the Python Source Code

  6.5

  A social media trick shows that blocking the "claude" user on GitHub reveals projects using Claude Code. The CPython repository, one of the world's most popular open-source projects, now displays contributions from this AI coding agent.