> Where did the litellm files come from? Do you know which env? Are there report... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

S0y 3 months ago | parent | context | favorite | on: My minute-by-minute response to the LiteLLM malwar...

> Where did the litellm files come from? Do you know which env? Are there reports of this online?

> The litellm_init.pth IS in the official package manifest — the RECORD file lists it with a sha256 hash. This means it was shipped as part of the litellm==1.82.8 wheel on PyPI, not injected locally.

> The infection chain:

> Cursor → futuresearch-mcp-legacy (v0.6.0) → litellm (v1.82.8) → litellm_init.pth

This is the scariest part for me.

RALaBarge 3 months ago [–]

Maybe the people who use emacs for everything are the only safe ones?

darkstarsys 3 months ago | [–]

straight and elpaca etc. are just as vulnerable. Maybe more so.

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact