#pypi on Hacker News

13 stories tagged pypi, newest first.

Screenshot of safedep.io: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor (safedep.io)

582 points by abhisek 5 days ago | 192 comments

SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.

supply-chain-attack litellm pypi python

Screenshot of github.com: Show HN: Strot – Compile an LLM's intent once, run decisions locally forever

Show HN: Strot – Compile an LLM's intent once, run decisions locally forever (github.com)

17 points by solohunter001 7 days ago | 4 comments

GitHub repository for STROT, a tool that uses an LLM at compile time to synthesize code for deterministic, self-routing NLU runtimes that run locally.

llm code-synthesis nlu python

Screenshot of manifold.security: Ask a model if code is malicious and it reaches for its morals

Ask a model if code is malicious and it reaches for its morals (manifold.security)

9 points by codyznash 20 days ago | 1 comments

A Manifold research blog post examining how language models fall back on moral reasoning when asked whether code packages like PyPI libraries are malicious.

malware-detection llm pypi supply-chain-security

Screenshot of awesomedataviz.com: Show HN: Dataviz, ranked daily from GitHub, NPM, PyPI and CRAN

Show HN: Dataviz, ranked daily from GitHub, NPM, PyPI and CRAN (awesomedataviz.com)

9 points by javierluraschi 22 days ago | 2 comments

AwesomeDataviz is a community-curated directory of 291 data visualization tools ranked daily using GitHub, npm, PyPI and CRAN data.

data-visualization charting-libraries awesome-list github

Screenshot of semgrep.dev: Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library (semgrep.dev)

450 points by j12y 5 months ago | 172 comments

Semgrep security research post reporting that PyPI package lightning versions 2.6.2 and 2.6.3 were compromised with Shai-Hulud themed credential-stealing malware.

supply-chain-attack pypi pytorch-lightning shai-hulud

Screenshot of futuresearch.ai: My minute-by-minute response to the LiteLLM malware attack

My minute-by-minute response to the LiteLLM malware attack (futuresearch.ai)

415 points by Fibonar 7 months ago | 153 comments

A FutureSearch engineer's blog post with the Claude Code transcript of discovering the compromised LiteLLM PyPI release and getting it quarantined.

supply-chain-attack litellm pypi malware

Screenshot of answer.ai: So where are all the AI apps?

So where are all the AI apps?(answer.ai)

330 points by tanelpoder 7 months ago | 305 comments

Answer.AI blog post examining PyPI package creation and update data to look for evidence that AI coding tools have increased software output.

ai-coding vibe-coding pypi python

Screenshot of github.com: Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer

Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer (github.com)

701 points by theanonymousone 7 months ago | 281 comments

GitHub issue in BerriAI/litellm reporting a malicious litellm_init.pth file in the 1.82.8 PyPI package that steals credentials via a supply chain compromise.

supply-chain-attack pypi litellm python

Screenshot of github.com: Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised

Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised (github.com)

888 points by dot_treo 7 months ago | 467 comments

GitHub issue in the BerriAI/litellm repo reporting a malicious litellm_init.pth in PyPI release 1.82.8 that acts as a credential stealer.

supply-chain-attack litellm pypi python

Screenshot of simonwillison.net: ChatGPT Containers can now run bash, pip/npm install packages and download files

ChatGPT Containers can now run bash, pip/npm install packages and download files (simonwillison.net)

432 points by simonw 9 months ago | 305 comments

Simon Willison's blog post describing undocumented upgrades to ChatGPT's code container: running Bash, Node.js and other languages, pip/npm installs via proxy, and file downloads.

chatgpt code-interpreter openai sandboxing

Screenshot of pyfound.blogspot.com: PSF has withdrawn $1.5M proposal to US Government grant program

PSF has withdrawn $1.5M proposal to US Government grant program (pyfound.blogspot.com)

634 points by lumpa 1 year ago | 611 comments

Python Software Foundation blog post explaining why it withdrew a $1.5M proposal to the US NSF Safety, Security, and Privacy of Open Source Ecosystems grant program.

python-software-foundation python nsf government-funding

Screenshot of kvinogradov.com: I algorithmically donated $5000 to Open Source

I algorithmically donated $5000 to Open Source (kvinogradov.com)

337 points by lorey 1 year ago | 73 comments

Blog post by Konstantin Vinogradov describing how he used GitHub Sponsors and PyPI data to algorithmically donate over $5000 to open source maintainers.

open-source-funding github-sponsors pypi python

Screenshot of blog.pypi.org: PyPI Was Subpoenaed

PyPI Was Subpoenaed (blog.pypi.org)

1073 points by quercusa 3 years ago | 535 comments

PyPI blog post disclosing that the PSF received three DOJ subpoenas in 2023 for user data on five PyPI accounts, detailing what was requested and provided.

pypi python-software-foundation subpoena user-privacy