13 ms·

My minute-by-minute response to the LiteLLM malware attack

• jeremie_strand 6mo ago
  [flagged]
• hmokiguess 6mo ago
  Does anyone have an idea of the impact of this out there? I am curious to the extent of the damage done by this
• anlka 6mo ago
  [flagged]
  • hxugufjfjf 6mo ago
    Maybe you’re conflating Claude with clawdbot? Either way, both can be used for good and evil. Would you make the same argument about knives being a huge net negative?
• Fibonar 6mo ago
  Callum here, I was the developer that first discovered and reported the litellm vulnerability on Tuesday. I’m sharing the transcript of what it was like figuring out what was going on in real time, unedited with only minor redactions. I didn’t need to recount my thought process after the fact. It’s the very same ones I wrote down to help Claude figure out what was happening. I’m an ML engineer by trade, so having Claude walk me through exactly who to contact and a step by step guide of time-critical actions felt like a game-changer for non-security researchers. I'm curious whether the security community thinks more non-specialists finding and reporting vulnerabilities like this is a net positive or a headache?
  • Bullhorn9268 6mo ago
    Not a security researcher, but this is IMHO obviously positive that the other side of the arms race is also getting stronger, and I would argue it's stronger than on the bad guys' side, due to the best being somewhat responsible and adding guardrails. I like the presentation <3.
  • rgambee 6mo ago
    I've heard stories lately of open source projects being inundated with vulnerability reports and PRs. But in this case, it seems like AI assistance was clearly a boon for root-causing and reporting this so quickly.
    • latexr 6mo ago
      Yes, in this case. Chances are in the future others will be missed despite being reported, because the maintainers are either inundated or tired of all the other reports and can’t distinguish the real one.
  • dot_treo 6mo ago
    Looks like we discovered it at essentially the same time, and in essentially the same way. If the pth file didn't trigger a fork-bomb like behavior, this might have stayed undiscoverd for quite a bit longer. Good thinking on asking Claude to walk you through on who to contact. I had no idea how to contact anyone related to PyPI, so I started by shooting an email to the maintainers and posting it on Hacker News. While I'm not part of the security community, I think everyone who finds something like this, should be able to report it. There is no point in gatekeeping the reporting of serious security vulnerabilities.
    • deleted 6mo ago
      [deleted]
    • notatallshaw 6mo ago
      > I had no idea how to contact anyone related to PyPI https://pypi.org/security/ https://pypi.org/security/: > If you've identified a security issue with a project hosted on PyPI Login to your PyPI account, then visit the project's page on PyPI. At the bottom of the sidebar, click Report project as malware.
• deleted 6mo ago
  [deleted]
• cedws 6mo ago
  GitHub, npm, PyPi, and other package registries should consider exposing a firehose to allow people to do realtime security analysis of events. There are definitely scanners that would have caught this attack immediately, they just need a way to be informed of updates.
  • Fibonar 6mo ago
    So I've been thinking about this a lot since it happened. I've already added dependency cooldowns https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html https://nesbitt.io/2026/03/04/package-managers-need-to-cool-... to every part of our monorepo. The obvious next thought is "am I just dumping the responsibility onto the next person along"? But as you point out it just needs to give automated scanners enough time to pick up on obvious signs like the .pth file in this case.
    • cedws 6mo ago
      It is in a sense dumping responsibility, but there’s a legion of security companies out there scanning for attacks all the time now to prove their products. They’re kind of doing a public service and you’re giving them a chance to catch attacks first. This is why I think dep cooldowns are great.
  • simonw 6mo ago
    PyPI does exactly that, and it's been very effective. Security partners can scan packages and use the invite-only API to report them: https://blog.pypi.org/posts/2024-03-06-malware-reporting-evolved/#via-api https://blog.pypi.org/posts/2024-03-06-malware-reporting-evo...
    • staticassertion 6mo ago
      PyPI is pretty best-in-class here and I think that they should be seen as the example for others to pursue. The client side tooling needs work, but that's a major effort in and of itself.
    • cedws 6mo ago
• dmitrygr 6mo ago
  Consider this your call to write native software. There is yet to be a supply chain attack on libc
  • ddp26 6mo ago
    Sure, but this is a pretty onerous restriction. Do you think supply chain attacks will just get worse? I'm thinking that defensive measures will get better rapidly (especially after this hack)
    • dmitrygr 6mo ago
      > Do you think supply chain attacks will just get worse? I'm thinking that defensive measures will get better rapidly (especially after this hack) I think the attacks will get worse and more frequent -- ML tools enable doing it easily among people who were previously not competent enough to pull it off but now can. There is no stomach for the proper defensive measures among the community for either python or javascript. Why am i so sure? This is not the first, second, third, or fourth time this has happened. Nothing changed.
      • applfanboysbgon 6mo ago
        Not only do the tools enable incompetent attackers, they also enable a new class of incompetent library developers to create and publish packages, and a new class of incompetent application developers to install packages without even knowing what packages are being used in the code they aren't reading, and a new class of incompetent users who are allowing OpenClaw to run completely arbitrary code on their machines with no oversight. We are seeing only the tip of the iceberg of the security breaches that are to come.
        • dmitrygr 6mo ago
          100%
        • mckennameyer 6mo ago
          So basically the attacker and the dev who caught it were probably using the same tools if the malware was AI-generated (hence the fork bomb bug), and the investigation was AI-assisted (hence the speed). Less "tip of the iceberg" and more just that both sides got faster.
• simonw 6mo ago
  First time I've seen my https://github.com/simonw/claude-code-transcripts https://github.com/simonw/claude-code-transcripts tool used to construct data that's embedded in a blog post, that's a neat way to use it. I usually share them as HTML pages in Gists instead, e.g. whttps://gisthost.github.io/?effbdc564939b88fe5c6299387e217da/index.html https://gisthost.github.io/?effbdc564939b88fe5c6299387e217da...
  • Fibonar 6mo ago
    I’m a big proponent of it within our company! CC tried to style it to blend in with our blog but it was kind of a disaster. Definitely had a new appreciation for the out-of-the-box experience. I also tried to include the individual sub-pages of Claude investigating but it really trawled my whole machine looking for malware. Don’t know if you’ve thought of any systematic ways of redacting the endless pages of detailed logs?
  • ddp26 6mo ago
    Yeah, sharing information across Claude Code sessions really is a problem that needs solving. An urgent hack, where you're using Claude Code to debug and trying to get help from your team, is one such case.
• moralestapia 6mo ago
  *salutes* Thank you for your service, this brings so much context into view, it's great.
• deleted 6mo ago
  [deleted]
• S0y 6mo ago
  > Where did the litellm files come from? Do you know which env? Are there reports of this online? > The litellm_init.pth IS in the official package manifest — the RECORD file lists it with a sha256 hash. This means it was shipped as part of the litellm==1.82.8 wheel on PyPI, not injected locally. > The infection chain: > Cursor → futuresearch-mcp-legacy (v0.6.0) → litellm (v1.82.8) → litellm_init.pth This is the scariest part for me.
  • RALaBarge 6mo ago
    Maybe the people who use emacs for everything are the only safe ones?
    • darkstarsys 6mo ago
      straight and elpaca etc. are just as vulnerable. Maybe more so.
• Bullhorn9268 6mo ago
  The fact pypi reacted so quickly and quarantined the package in like 30 minutes after the report is pretty great!
  • ddp26 6mo ago
    Agree, lots of hand wringing about us being so vulnerable to supply chain attacks, but this was handled pretty well all things considered
• Shank 6mo ago
  Probably one of the best things about AI/LLMs is the democratization of reverse engineering and analysis of payloads like this. It’s a very esoteric skill to learn by hand and not very immediately rewarding out of intellectual curiosity most times. You can definitely get pointed in the right direction easily, now, though!
  • Fibonar 6mo ago
    I’ve entertained myself with CTF walkthroughs on YouTube before and had been meaning to try it out. But yeah I feel it falls under the same category as lock picking, fun to LARP, unlikely to stumble across in my day job.
  • gus_ 6mo ago
    In this case, this has nothing to do with reverse engineering, it's basic system administration. See how the AI points you in the "right" direction: What likely happened: The exec(base64.b64decode('...')) pattern is not malware — it's how Python tooling (including Claude Code's Bash tool) passes code snippets to python -c while avoiding shell escaping issues. Any base64 string passed to python via cmdline should be considered as HIGHLY suspicious, by default. Or anything executed from /tmp, /var/tmp, /dev/shm. Exfiltrates data to https://models.litellm.cloud/ encrypted with RSA if @op would have had Lulu or LittleSnitch installed, they would probably have noticed (and blocked) suspicious outbound connections from unexpected binaries. Having said this, uploading a binary to Claude for analysis is a different story.
    • recursivegirth 6mo ago
      Thanks, learned something new. I found and setup Open Snitch on my machine - super intuitive. This is going to give me great peace of mind.
• aplomb1026 6mo ago
  [dead]
• cdcarter 6mo ago
  If it weren't for the 11k process fork bomb, I wonder how much longer it would have taken for folks to notice and cut this off.
  • intothemild 6mo ago
    Thats the thing, i noticed it almost instantly when trying to install a package that depended on it, as soon as it started, it hard locked my laptop, didn't get to infect it.. but if they had slowed down that fork bomb.. it would have done more damage.
    • ddp26 6mo ago
      Yeah, and this is a pattern I saw in the Fancy Bear Goes Fishing book, a lot of discovery of malware is either pure luck, or blunders from the malware developers. https://en.wikipedia.org/wiki/Fancy_Bear_Goes_Phishing https://en.wikipedia.org/wiki/Fancy_Bear_Goes_Phishing
  • yaur 6mo ago
    This generation's internet worm?
  • jamiemallers 6mo ago
    [dead]
• __mharrison__ 6mo ago
  Interesting world we live in. I just finished teaching an advanced data science course for one of my clients. I found my self constantly twitching everytime I said "when I write code..." I'm barely writing code at all these days. But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. Tested and uploaded to pypi in 90 minutes. A lot of the conversation in my course was directed to leveraged AI (and discussions of existential dread of AI replacement). This article is a wonderful example of an expert leveraging AI to do normal work 100x faster.
  • pxtail 6mo ago
    Only $100k worth code? Rookie numbers, you must be new to the game
    • __mharrison__ 6mo ago
      Doing my part to burn $50k tokens in a year as per the Jensen mandate.
  • masijo 6mo ago
    >But I created $100k worth of code just yesterday recreating a poorly maintained (and poor ux) library. How, exactly, are you calculating the worth of your code? Did you manage to sell in the same day? Why is it "worth $100k"?
    • __mharrison__ 6mo ago
      sloccount
      • croemer 6mo ago
        So the more junk lines the more it's worth. Right. Don't use bogus $ from sloccount. Just say I created a 10k line project.
        • 6mo ago
• Yanko_11 6mo ago
  [dead]
• tomalbrc 6mo ago
  Hmm a YCombinator backed company, I'm not surprised.
• rpodraza 6mo ago
  At this point I'd highly recommend everyone to think twice before introducing any dependencies especially from untrusted sources. If you have to interact with many APIs maybe use a proxy instead, or roll your own.
  • StrauXX 6mo ago
    LiteLLM isn't a good choice for a proxy in any case. It introduces a lot of lag amd latency and the features are often half baked. To me, it looks like a vibecoded application without a product owner. And the code itself isn't very organized either. I evaluated it for a project a few months ago and will never use it for anything production. Theres a few much better alternatives out there.
    • minhduc0711 6mo ago
      Could you name some of these better alternatives?
      • StrauXX 6mo ago
        If your requirements are just to load balance between selhosted AI servers: nginx. If you want a more thorough system with configurability, logging, etc.: Bifrost from MaximAI
• CrzyLngPwd 6mo ago
  The fascinating part for me is how they chatted with the machine, such as; "Please write a short blog post..." "Can you please look through..." "Please continue investigating" "Can you please confirm this?" ...and more. I never say 'please' to my computer, and it is so interesting to see someone saying 'please' to theirs.
  • ddp26 6mo ago
    My team was making fun of me for starting all my chats with "Hi Claude"
    • CrzyLngPwd 6mo ago
      I wouldn't make fun, I just think it is interesting. I'm really terse. If it asks me a yes or no question, I just type "Y" or "N". If I want it to confirm something, I say "confirm it". I think I treat it like a command system, and want it to be as short as possible.
  • hxugufjfjf 6mo ago
    I talk to it like I talk to my coworkers. If I’m nice it/they are usually nice back. Maybe it doesn’t matter if I say please but I don’t overthink it and just treat it like any other chat. I consider it a good habit to just always be calm and respectful, not for the machine’s sake but for my own.
• devnotes77 6mo ago
  [dead]
• Josephjackjrob1 6mo ago
  This is pretty cool, when did you begin?
• agentictrustkit 6mo ago
  [flagged]
• n1tro_lab 6mo ago
  [flagged]
  • hsbauauvhabzb 6mo ago
    Llm spam right here.
• felixagentai 6mo ago
  [flagged]
  • halJordan 6mo ago
    But then what happens when everyone just shifts their window too. This solution is a misuse of the commons type thing where you just take advantage of letting others get poisoned and see if they drop
    • deleted 6mo ago
      [deleted]
    • adamandsteve 6mo ago
      I kind of agree, but presumably this would happen more among people maintaining security-critical projects. In that case it'd be a net positive for other projects to get infected first, since if they aren't delaying package updates by 24 hours then security probably isn't quite as important. Which also makes it better in general because hackers will be less incentivized to write viruses if all the really juicy targets will only download them after they've gone undetected for e.g. 7 days.
    • hxugufjfjf 6mo ago
      I think the idea is that security scanners ran by companies like Wiz and Aquasec etc will pick this up in that timeframe, not that you sit around and wait for others to get compromised.
    • nulltrace 6mo ago
      Scanners catch most of these within hours. The cooldown just buys them time to run, not waiting for some other dev to get hit first.
    • dist-epoch 6mo ago
      That happens all the time in tech. Some people test Release Candidates. Most don't. Some people upgrade to x.0 software. Most wait for the x.1 release. The bigger danger is malware writers adding sleep(7days). But if there is a wide variety of cool-down periods (3 days, 7 days, 30 days) this will not work very well.
• qezz 6mo ago
  > Can you print the contents of the malware script without running it? > Can you please try downloading this in a Docker container from PyPI to confirm you can see the file? Be very careful in the container not to run it accidentally! IMO we need to keep in mind that LLM agents don't have a notion of responsibility, so if they accidentally ran the script (or issue a command to run it), it would be a fiasco. Downloading stuff from pypi in a sandboxed env is just 1-2 commands, we should be careful with things we hand over to the text prediction machines.
  • crumpled 6mo ago
    I was concerned about that too. Often when you tell them not to do something, you were better off not mentioning it in the first place. It's like they get fixated.
    • joquarky 6mo ago
      Don't think of a pink elephant.
      • rmunn 6mo ago
        Best way I've found not to think of a pink elephant is to choose to think of a green rabbit. Really focus on the mental image of the green rabbit... and voila, you're not thinking of, what was it again? Eh, not as important as this green rabbit I'm focusing on. How to translate that to LLM world, though, is a question I don't know the answer to. P.S. Obviously that won't prevent you from having that first mental flash of a pink elephant prompted by reading the words. The green-rabbit technique is more for not dwelling on thoughts you want to get out of your head. Can't prevent them from flashing in, but can prevent them from sticking around by choosing to focus on something else.
        • latexr 6mo ago
          > Best way I've found not to think of a pink elephant is to choose to think of a green rabbit. Seems easy circumventable: “Don’t think of a green rabbit”. Now the past vividness of that image becomes a hindrance.
• sva_ 6mo ago
  > I just opened Cursor again which triggered the malicious package again. Can you please check the files are purged again? Verified derp moment - had me smiling
  • Fibonar 6mo ago
    I went to read the advisory post and chose double clicking it from Finder instead of vim for whatever reason. I was actually on a call with my manager as it happened, I had time to watch my computer start to freeze up again and say my goodbyes before the inevitable hard reset!
• qcautomation 6mo ago
  [dead]
• JulianPembroke 6mo ago
  [dead]
• inglor 6mo ago
  We mitigate this attack with the very uninspiring "wait 24h before dep upgrades" solution which is luckily already supported in uv.
  • ddp26 6mo ago
    Yeah, but uvx has this thing where it can automatically build the latest environment, and pull the latest (unpinned) version, right?
• kpw94 6mo ago
  The options from big companies to run untrusted open source code are: 1) a-la-Google: Build everything from source. The source is mirrored copied over from public repo. (Audit/trust the source every time) 2) only allow imports from a company managed mirror. All imported packages needs to be signed in some way. Here only (1) would be safe. (2) would only be safe if it's not updating the dependencies too aggressively and/or internal automated or manual scanning on version bumps would catch the issue . For small shops & individuals: kind of out of luck, best mitigation is to pin/lock dependencies and wait long enough for hopefully folks like Fibonar to catch the attack... Bazel would be one way to let you do (1), but realistically if you don't have the bandwidth to build everything from source, you'd rely on external sources with rules_jvm_external or locked to a specific pip version rules_pyhton, so if the specific packages you depend on are affected, you're out of luck.
• deathanatos 6mo ago
  I am confused; did you ever actually email anyone about the vuln? The AI suggests emailing security emails multiple times, but as I'm reading the timeline, none of the points seem to suggest this was ever done, only that a blog post was made, shared on Reddit, and then indirectly, the relevant parties took action. I'm hoping this just isn't on the timeline.
  • quietbritishjim 6mo ago
    The first line of the post is: > I'm the engineer who got PyPI to quarantine litellm. In guessing they used a tool other than Claude Code to serve the email.
    • deathanatos 6mo ago
      "got" can be read as "indirectly, via a blog post, which I think they reacted to"
      • Fibonar 6mo ago
        I've updated the timeline to clarify I did in fact email them. I’m not yet at the point of having Claude write my emails for me, in fact it was my first one sent since joining the company 10 months ago!
        • dingdongditchme 6mo ago
          Wait, what? You sent a single email being in a company for ten months?? Or was it the first external email?
• manudaro 6mo ago
  [dead]
• nubinetwork 6mo ago
  I have a hard time believing that Claude instantly figured out this was malware... I've fed it obfuscated JavaScript before, and it couldn't figure it out... and then there was the time I tried to teach it nftables... whooo boy...
  • Filligree 6mo ago
    Except in this case the code wasn't obfuscated, right?
  • ares623 6mo ago
    I think the usual response to that is "have you tried again recently?"
    • nubinetwork 6mo ago
      3 weeks ago?
  • phyzome 6mo ago
    Hard to know with this nondeterministic shit.
  • rgovostes 6mo ago
    If you read the transcript it repeatedly made the incorrect assertion (hallucinated) that it’s totally normal for Claude Code to use Base64 armoring. It’s not surprising it can “read” Base64 though; such was demonstrated back in GPT-3 days. Nontrivial obfuscation might not be one-shotted, but Claude has access to a code interpreter and can certainly extract and step through the decoder routine itself as a malware analyst would. nftables is a different problem though. It’s apparent that if something isn’t well understood—i.e, there are tons of badly-formed examples on StackExchange—LLMs will fail to learn it too. I’ve seen this with things as “simple” as Bash string interpolation rules like ${var:+blah}. More often than not I’m humbled when I think I’ll learn it better and then find myself swearing at poorly-written documentation and patently false Q&A advice.
  • dns_snek 6mo ago
• ruszki 6mo ago
  Why is there a discrepancy between the timeline (which supposed to be UTC, and stated as 11:09), and the "shutdown timeline" (stated as 01:36-01:37)? There is no +2:30 timezone, not SDT and not DST. There is a single place on Earth where there is -9:30, and that's Marquesas Islands. What do I miss?
  • Aramgutang 6mo ago
    That was a false lead, where Claude was investigating the wrong event. There's a yellow note on the side of interaction #1 pointing it out, and it's made even more clear if you fully read interactions #5 and #6.
• Archiebuilds 6mo ago
  [dead]
• A04eArchitect 6mo ago
  [dead]
• devnotes77 6mo ago
  [dead]
• diablevv 6mo ago
  [dead]
• craxyfrog 6mo ago
  [dead]
• ejaKh 6mo ago
  Anthropic is back to flagging after their Maven assisted Iran murder.
• getverdict 6mo ago
  [dead]
• getverdict 6mo ago
  [dead]
• elicohen1000 6mo ago
  [dead]
• silversmith 6mo ago
  What stands out to me the most: > Blog post written, PR'd, and merged in under 3 minutes. It's close to or even faster than the time it takes me to read it. I'm struggling to put into words how that makes me feel, but it's not a good feeling.
• pugchat 6mo ago
  [dead]
• motbus3 6mo ago
  I literally pressed sync dependencies button 1 minute after the malware version was removed. I guess thanks
• paxrel_ai 6mo ago
  [dead]
• someguydave 6mo ago
  apparently PyPI supports "digital attestation" (signed binaries?) Was this package signed? https://docs.pypi.org/trusted-publishers/ https://docs.pypi.org/trusted-publishers/
• agentictrustkit 6mo ago
  One thing that jumps out in these incidents is how quickly we shift from "package integrituy" to "operator integrity." Once an LLM is in the loop (even as a helper0, its effectevly acting as an operator that can influence time-critical actions like who you contact, what you run, and what you trust. In more regulated environments we deal with this by separating advice, authority and evidence (or the receipts). The useful analogue here is to keep the model in the "propose" role. but require deterministic gates for actions with side effects, and log the decisions as an auditable trail. I personally don't think this eliminates the problem (attackers will still attack), but it changes the failure mode from "the assistant talked me into doing a danerous thing" to "the assistant suggested it and the policy/gate blocked it." That's the big difference between a contained incident and a big headline.
• ercu 6mo ago
  You did the hard work actually to convince Claude to research deeper, as everytime it said no problem exists. That shows Claude thinking/research was not very deep. This time, the juniorness of the hacker helped the malware to be discovered faster (recursive forks), next time might be harder.
• cndg 6mo ago
  LiteLLM Security Certifications Certification Status SOC 2 Type I Certified. Report available upon request on Enterprise plan. SOC 2 Type II Certified. Report available upon request on Enterprise plan. ISO 27001 Certified. Report available upon request on Enterprise ROFL
• clawbridge 6mo ago
  [dead]