{"id":166049,"date":"2026-03-24T23:12:56","date_gmt":"2026-03-24T21:12:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz"},"modified":"2026-03-24T23:12:56","modified_gmt":"2026-03-24T21:12:56","slug":"v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","title":{"rendered":"PyPI-s on saadaval pahatahtlikud versioonid LiteLLM raamatukogust, millel on 95 miljonit allalaadimist kuus.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Python'i LiteLLM teegraafikud, mis saavad 95 miljonit allalaadimist kuus ja 3,5 miljonit viimase 24 tunni jooksul, teatasid projekti kompromiteerimisest. R\u00fcndajad suutsid saada kuritarvitatavad v\u00f5rguandmed ja avaldada PyPI's kaks pahatahtlikku versiooni \u2014 1.82.7 ja 1.82.8, mis sisaldavad koodi v\u00f5tmete ja paroolide varastamiseks kasutajate s\u00fcsteemidest. Praegu on pahatahtlikud versioonid PyPI's eemaldatud ja projekt on ajutiselt k\u00fclmutatud kuni uurimise l\u00f5puni. <\/p>\n

LiteLLMi PyPI kontole p\u00e4\u00e4senud juurdep\u00e4\u00e4sutoken sattus r\u00fcndajate k\u00e4tte, kuna pideva integreerimise s\u00fcsteemis kasutati s\u00f5ltuvuste turvatesti skannerit trivvy. Varem veebruaris suutsid r\u00fcndajad p\u00e4\u00e4seda Trivy infrastruktuuri, kasutades \u00e4ra haavatavust pull_request_target t\u00f6\u00f6tlejas, mis k\u00e4ivitub Trivy pideva integreerimise s\u00fcsteemis. P\u00e4rast kompromiteerimist avaldasid r\u00fcndajad pahavara versioone Trivy 0.69-0.69, asendasid GitHub Action t\u00f6\u00f6tleja trivy-action ja panid \u00fcles muudetud Docker-pildi Trivyst. <\/p>\n

24. m\u00e4rtsil kell 11:30 (MSK) kasutati LiteLLM'i saatja (krrishdholakia) kompromiteeritud andmeid pahatahtlike LiteLLM 1.82.7 ja 1.82.8 versioonide otsepakkumiseks PyPI's, m\u00f6\u00f6da minnes ametlikust GitHub CI\/CD'st. Projekti hoidla GitHub'is ei olnud m\u00f5jutatud \u2014 pahatahtlik tegevus oli t\u00e4heldatud ainult PyPI's. LiteLLM 1.82.7 versioonis oli pahatahtlik kood sisse ehitatud faili litellm\/proxy\/proxy_server.py ja aktiveerus litellm.proxy impordimisel. Versioonis 1.82.8 sisaldas komposiit faili site-packages\/litellm_init.pth, ning faili proxy_server.py oli lisatud t\u00f6\u00f6tleja, mis oli pakitud base64 formaadis ja aktiveerus igal k\u00e4ivitamisel. <\/p>\n

Lisatud pahatahtlik kood skannib ja saadab konfidentsiaalset teavet. Saadetakse leitud s\u00fcsteemi SSH ja SSL\/TLS v\u00f5tmed, keskkonnamuutujate sisu, AWS, GCP, Azure ja K8s kontode andmed, kr\u00fcptovaluuta rahakottide v\u00f5tmed, andmebaasi paroolid, k\u00e4surea tegevuse ajalugu, konfiguratsioonifailid Giti, CI\/CD, pakettide haldurite ja Dockeri jaoks. Leitud andmed kr\u00fcpteeritakse AES-256-CBC + RSA-4096 algoritmide abil ja saadetakse HTTP POST-p\u00e4ringuga saidile \"https:\/\/models.litellm.cloud\/\"domeen<\/a> litellm.cloud registreeriti mitu tundi enne pahavara versioonide avaldamist). <\/p>\n

LiteLLM kasutajatel on soovitatav kontrollida, et kataloogis site-packages ei oleks faili litellm_init.pth, uuendada k\u00f5iki v\u00f5tmeid ja mandaate, kui on installitud versioon 1.82.7 v\u00f5i 1.82.8, fikseerida konkreetsed LiteLLM versioonid s\u00f5ltuvuste laadimise parameetrites ning v\u00f5rrelda kasutatavaid LiteLLM v\u00e4ljalaskeid GitHubi v\u00e4ljalaske koodiga.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LiteLLM, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 95 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043c\u0435\u0441\u044f\u0446 \u0438 3.5 \u043c\u043b\u043d \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0441\u0443\u0442\u043a\u0438, \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u0432 PyPI \u0434\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 — 1.82.7 \u0438 1.82.8, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043a\u043e\u0434 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u044b \u0438\u0437 PyPI, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-166049","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PyPI-s on avaldatud pahatahtlikud LiteLLM raamatukogu v\u00e4ljalasked, millel on 95 miljonit allalaadimist kuus | ProHoster","description":"LiteLLM Python'i raamatukogu arendajad, millel on 95 miljonit allalaadimist kuus ja 3,5 miljonit viimase 24 tunni jooksul, teatasid projekti kompromiteerimisest.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LiteLLM, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 95 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043c\u0435\u0441\u044f\u0446 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Python-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LiteLLM, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 95 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043c\u0435\u0441\u044f\u0446 \u0438 3.5 \u043c\u043b\u043d \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0441\u0443\u0442\u043a\u0438, \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-24T21:12:56+00:00","article:modified_time":"2026-03-24T21:12:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/166049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=166049"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/166049\/revisions"}],"predecessor-version":[{"id":168123,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/166049\/revisions\/168123"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=166049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=166049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=166049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}