{"id":166049,"date":"2026-03-24T23:12:56","date_gmt":"2026-03-24T21:12:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz"},"modified":"2026-03-24T23:12:56","modified_gmt":"2026-03-24T21:12:56","slug":"v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-pypi-razmeshheny-vredonosnye-vypuski-biblioteki-litellm-naschityvayushhej-95-mln-zagruzok-v-mesyacz","title":{"rendered":"N\u00eb PyPI jan\u00eb publikuar l\u00ebshime t\u00eb d\u00ebmshme t\u00eb bibliotek\u00ebs LiteLLM, e cila ka 95 milion shkarkime n\u00eb muaj","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Zhvilluesit e bibliotek\u00ebs Python LiteLLM, e cila ka 95 milion shkarkime n\u00eb muaj dhe 3.5 milion n\u00eb 24 or\u00ebt e fundit, njoftuan p\u00ebr kompromitimin e projektit. Sulmuesit arrit\u00ebn t\u00eb kapnin kredencialet e mb\u00ebshtetjes dhe publikuan n\u00eb PyPI dy versione t\u00eb d\u00ebmshme \u2014 1.82.7 dhe 1.82.8, q\u00eb p\u00ebrmbanin kod p\u00ebr vjedhjen e \u00e7el\u00ebsave dhe fjal\u00ebkalimeve nga sistemet e p\u00ebrdoruesve. Aktualisht, versionet d\u00ebmshme jan\u00eb fshir\u00eb nga PyPI, dhe projekti \u00ebsht\u00eb pezulluar p\u00ebrkoh\u00ebsisht derisa t\u00eb p\u00ebrfundoj\u00eb hetimi. <\/p>\n
Tokeni i aksesit n\u00eb llogarin\u00eb LiteLLM n\u00eb PyPI ra n\u00eb dor\u00ebn e sulmuesve p\u00ebr shkak t\u00eb p\u00ebrdorimit n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm t\u00eb skanerit t\u00eb siguris\u00eb s\u00eb var\u00ebsive trivvy. Para k\u00ebsaj, n\u00eb fund t\u00eb shkurtit, sulmuesit arrit\u00ebn t\u00eb merrnin akses n\u00eb infrastruktur\u00ebn e projektit Trivy, duke shfryt\u00ebzuar nj\u00eb dob\u00ebsim n\u00eb p\u00ebrpunuesin pull_request_target, i cili aktivizohej n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm Trivy. Pas kompromisit, sulmuesit publikuan versionet e d\u00ebmshme Trivy 0.69-0.69, falsifikuan p\u00ebrpunuesin GitHub Action trivy-action dhe publikuan nj\u00eb imazh t\u00eb modifikuar Docker me Trivy. <\/p>\n
M\u00eb 24 mars n\u00eb 11:30 (MSK), kredencialet e mb\u00ebshtetjes s\u00eb LiteLLM (krrishdholakia) u p\u00ebrdor\u00ebn p\u00ebr publikimin direkt t\u00eb versioneve t\u00eb d\u00ebmshme LiteLLM 1.82.7 dhe 1.82.8 n\u00eb PyPI, duke anashkaluar CI\/CD-n\u00eb zyrtare t\u00eb GitHub-it. Repozitori i projektit n\u00eb GitHub nuk u prekur \u2014 aktiviteti i d\u00ebmsh\u00ebm ishte v\u00ebrejtur vet\u00ebm n\u00eb PyPI. N\u00eb versionin LiteLLM 1.82.7, kodi i d\u00ebmsh\u00ebm ishte i p\u00ebrfshir\u00eb n\u00eb skedarin litellm\/proxy\/proxy_server.py dhe u aktivizua kur u importua litellm.proxy. N\u00eb versionin 1.82.8, ishte p\u00ebrfshir\u00eb skedari site-packages\/litellm_init.pth, dhe n\u00eb skedarin proxy_server.py ishte shtuar nj\u00eb trajtues, i paketuar n\u00eb formatin base64 dhe i aktivizuar gjat\u00eb \u00e7do nisjeje. <\/p>\n
Kodi i d\u00ebmsh\u00ebm t\u00eb cilit iu shtua u angazhua n\u00eb skanimin dhe d\u00ebrgimin e t\u00eb dh\u00ebnave konfidenciale. U d\u00ebrguan \u00e7el\u00ebsat SSH dhe SSL\/TLS t\u00eb gjetur n\u00eb sistem, p\u00ebrmbajtja e variablave t\u00eb mjedisit, kredencialet p\u00ebr AWS, GCP, Azure dhe K8s, \u00e7el\u00ebsat e portofol\u00ebve kripto, fjal\u00ebkalimet e DBMS-s\u00eb, historia e operacioneve n\u00eb interpreterin e komandave, skedar\u00ebt e konfigurimit nga Git, CI\/CD, menaxher\u00ebt e paketave dhe Docker. T\u00eb dh\u00ebnat e zbuluara u koduan duke p\u00ebrdorur algoritmet AES-256-CBC + RSA-4096 dhe u d\u00ebrguan p\u00ebrmes nj\u00eb k\u00ebrkese HTTP POST n\u00eb adres\u00ebn \"https:\/\/models.litellm.cloud\/\"domain<\/a> litellm.cloud u regjistrua disa or\u00eb para publikimit t\u00eb shkarkimeve t\u00eb d\u00ebmshme). <\/p>\n