\u00cbsht\u00eb e raportuar se nj\u00eb version i shkarkuar i bibliotek\u00ebs LiteLLM, q\u00eb ka 23 milion shkarkime n\u00eb jav\u00eb, \u00ebsht\u00eb publikuar n\u00eb depozitat PyPI me kod t\u00eb d\u00ebmsh\u00ebm dhe se \u00ebsht\u00eb injektuar kod i d\u00ebmsh\u00ebm n\u00eb imazhin zyrtar Docker t\u00eb projektit. Kjo nuk \u00ebsht\u00eb ngjarja e par\u00eb e till\u00eb me LiteLLM \u2014 n\u00eb mars t\u00eb k\u00ebtij viti, sulmuesit publikuan shp\u00ebrndarje t\u00eb d\u00ebmshme pas kapjes s\u00eb kredencialeve t\u00eb mb\u00ebshtetjeve. K\u00ebt\u00eb her\u00eb, sulmuesit lan\u00eb versionin LiteLLM 1.107.0, n\u00eb t\u00eb cilin ishte i integruar kodi i d\u00ebmsh\u00ebm p\u00ebr organizimin e ekzekutimit t\u00eb komandave n\u00eb distanc\u00eb, si dhe p\u00ebr k\u00ebrkimin dhe d\u00ebrgimin e kredencialeve, \u00e7el\u00ebsave dhe tokeneve t\u00eb aksesit.<\/p>\n
Kodi i d\u00ebmsh\u00ebm u injektua gjat\u00eb procesit t\u00eb nd\u00ebrtimit pa kompromentuar depozitat git. Pas instalimit, kodi i d\u00ebmsh\u00ebm aktivizohet para se t\u00eb importohet LiteLLM duke instaluar skedaret cook.pth, cook.py dhe sitecustomize.py n\u00eb drejtorin\u00eb e bibliotekave Python. K\u00ebto skedare ekzekutohen me \u00e7do rast q\u00eb Python ekzekutohet n\u00eb sistem pa nevoj\u00ebn q\u00eb p\u00ebrdoruesi t\u00eb kryej\u00eb veprime t\u00eb tjera. <\/p>\n
N\u00eb fillim, Python ekzekuton skedarin cook.pth, i cili ka vet\u00ebm nj\u00eb rresht \"import cook\" p\u00ebr t\u00eb importuar skriptin cook.py q\u00eb mbledh kredencialet. M\u00eb pas, importohet skripti sitecustomize.py, q\u00eb p\u00ebrdoret p\u00ebr ngarkimin n\u00eb sfond t\u00eb kodit t\u00eb jasht\u00ebm (parametrat e ngarkimit p\u00ebrcaktohen p\u00ebrmes lidhjes \"raw.githubusercontent.com\/letters9813\/pythonclient-test\/main\/domain.txt\"). Kodi i d\u00ebmsh\u00ebm n\u00eb t\u00eb dy skriptet \u00ebsht\u00eb kompresuar me zlib dhe koduar me metod\u00ebn Base64. Nj\u00eb tregues i kompromitimit mund t\u00eb jet\u00eb shfaqja n\u00eb sistem e skedar\u00ebve \"\/tmp\/.pc_once_*\" dhe \"\/tmp\/remote_code_loader.lock\".<\/p>\n
Pas aktivizimit, skedari cook.py skanon parametrat e lidhjes me sh\u00ebrbimet e cloud-it, depozitat dhe sistemet e integrimit t\u00eb vazhduesh\u00ebm (AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub CLI, Vault, Terraform, Packer), llogarit\u00eb e zhvilluesve, parametrat e lidhjes me Git, cil\u00ebsimet npm dhe PyPI, skedar\u00ebt me variabla ambienti, \u00e7el\u00ebsat e mbyllur p\u00ebr SSH, PGP dhe TLS, cil\u00ebsimet e mjeteve AI, databazat e shfletuesit me Cookie, t\u00eb dh\u00ebnat e ruajtura dhe historikun, informacionin mbi proceset dhe variablat e ambientit. T\u00eb dh\u00ebnat e zbuluara kriptohen duke p\u00ebrdorur algoritmet AES-256-CBC + RSA-4096 dhe d\u00ebrgohen n\u00eb form\u00ebn e nj\u00eb k\u00ebrkese verifikimi n\u00eb faqen litellm.dev, t\u00eb krijuar nga sulmuesit. \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 PyPI \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LiteLLM, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 23 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 Docker-\u043e\u0431\u0440\u0430\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u042d\u0442\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 LiteLLM — \u0432 \u043c\u0430\u0440\u0442\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e. \u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u043b\u0438 \u0432\u0435\u0440\u0441\u0438\u044e LiteLLM 1.107.0, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183962","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Malware \u00ebsht\u00eb injektuar n\u00eb paket\u00ebn PyPI dhe n\u00eb imazhin Docker me LiteLLM | ProHoster","description":"\u00cbsht\u00eb raportuar publikimi i nj\u00eb versioni t\u00eb d\u00ebmsh\u00ebm t\u00eb bibliotek\u00ebs LiteLLM n\u00eb repositorin PyPI, i cili ka arritur 23 milion shkarkime n\u00eb jav\u00eb, si dhe injektimi i kodit t\u00eb d\u00ebmsh\u00ebm n\u00eb imazhin zyrtar Docker t\u00eb projektit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/malware-injected-into-litellm-pypi-package-and-docker-image","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI-\u043f\u0430\u043a\u0435\u0442 \u0438 Docker-\u043e\u0431\u0440\u0430\u0437 \u0441 LiteLLM \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 PyPI \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LiteLLM, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 23 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 Docker-\u043e\u0431\u0440\u0430\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/malware-injected-into-litellm-pypi-package-and-docker-image","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-22T15:40:40+00:00","article:modified_time":"2026-10-22T15:40:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=183962"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183962\/revisions"}],"predecessor-version":[{"id":183963,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183962\/revisions\/183963"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=183962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=183962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=183962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"