⚠️ Security Notice: litellm 1.82.x Supply Chain Attack

[srbhr]

⚠️ Security Notice: litellm 1.82.8 Supply Chain Attack

If you are running Resume Matcher and recently upgraded litellm to version 1.82.x, please read this immediately.

A malicious file was discovered in the litellm==1.82.8 (some folks on hacker news are saying 1.82.7 or older have been compromised too) PyPI package that automatically steals and exfiltrates credentials (API keys, SSH keys, environment variables, cloud credentials) every time Python starts no import required.

References

• Original issue report (BerriAI/litellm #24512)
• Hacker News Discussion
• https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/
• https://www.prismor.dev/blog/litellm-pypi-supply-chain-compromise

[srbhr]

We're using:

"litellm==1.81.8",

From: apps/backend/requirements.txt
And:

apps/backend/pyproject.toml

[Suajay]

Thanks for sharing this.

[oPromessa]

@srbhr I noticed litellm being pinned to version 1.83.0. Does this solve and address this security issue ?

[srbhr]

Yes, I just updated it today. The litellm team says this is from their new hardened pipeline.

[renebell0]

What

[sarthak2443]

Litelm