PyPI Archive - Hey-GPT.de - Daily GenAI News Digest

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip instal

24. März 2026

GenAI Updates

LiteLLM PyPI Supply Chain Attack: How a Poisoned Package Exposed Developer Credentials

**Software Horror: The LiteLLM PyPI Supply Chain Attack** Every developer has typed it. `pip install…