4 ms·
Their Personal Access Token must’ve been pwned too, not sure through what mechanism though
by chunky1994 6mo ago
Their Personal Access Token must’ve been pwned too, not sure through what mechanism though
- Imustaskforhelp 6mo agoThey have written about it on github to my question: Trivvy hacked (https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/ https://www.aquasec.com/blog/trivy-supply-chain-attack-what-...) -> all circleci credentials leaked -> included pypi publish token + github pat -> | WE DISCOVER ISSUE | -> pypi token deleted, github pat deleted + account removed from org access, trivvy pinned to last known safe version (v0.69.3) What we're doing now: Block all releases, until we have completed our scans Working with Google's mandiant.security team to understand scope of impact Reviewing / rotating any leaked credentials https://github.com/BerriAI/litellm/issues/24518#issuecomment-4119972374 https://github.com/BerriAI/litellm/issues/24518#issuecomment...
- franktankbank 6mo agoDoes that explain how circleci was publishing commits and closing issues?
- celticninja 6mo ago69.3 isnt safe. The safe thing to do is remove all trivy access. or failing that version. 0.35 is the last and AFAIK only safe version. https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise https://socket.dev/blog/trivy-under-attack-again-github-acti...
- Imustaskforhelp 6mo agoI have sent your message to the developer on github and they have changed the version to 0.35.0 ,so thanks. https://github.com/BerriAI/litellm/issues/24518#issuecomment-4120401246 https://github.com/BerriAI/litellm/issues/24518#issuecomment...