A malicious LiteLLM 1.107.0 PyPI release installed a credential stealer and a persistent backdoor across Linux, macOS, and Windows wheels by dropping three files into site-packages: cook.pth, cook.py and sitecustomize.py. Both cook.py (loaded via cook.pth) and sitecustomize.py execute each time Python starts, so an infected host can be compromised even if litellm is never imported. The stealer harvests SSH keys, cloud/CI credentials, AI provider keys (from a LiteLLM proxy DB), browser passwords and other secrets, encrypts the data with AES-256-CBC and an embedded RSA public key, packages it and uploads it to www.litellm.dev/healthcheck with a specific X-Token header. The sdist’s pyproject.toml contained an extra maturin data entry that enabled inclusion of the malicious cook files; upstream GitHub lacked the implants and PyPI later removed the release. Nearby releases 1.106.2 and release candidates were clean.
sitecustomize.py forks into a detached daemon that locks /tmp/remote_code_loader.lock, reads a GitHub raw file for a domain, runs the embedded stealer repeatedly, and hourly downloads and execs remote code from /codepy, allowing dynamic second-stage payloads. The attacker’s GitHub account and domain file were deleted about two hours after upload, but hosts that already ran the daemon could have executed remote code. Key indicators include cook.pth/cook.py/sitecustomize.py in site-packages, /tmp/.pc_once_* marker, PRIVCOLLECT_ACTIVE in process environments, the remote-lock file, and Python processes contacting 169.254.169.254 for cloud metadata.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.