SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Malicious LiteLLM 1.107.0 uploaded to PyPI, stealing developer and AI tool credentials

0
·6 views

A malicious version of the LiteLLM Python package, 1.107.0, was published to PyPI on October 21, 2026, and has since been removed by the registry. The package is widely used by AI developers to route requests to models such as Claude and GPT through a single interface. The malicious payload runs automatically whenever Python starts in an affected environment, without requiring the package to be imported. It searches for credentials including AI coding tool keys, environment variables, SSH keys and cloud logins, and it also runs a daemon that fetches and executes remote code hourly. Version 1.106.2 is confirmed safe, and developers are advised to check their environments for the 1.107.0 dist-info folder and review lockfiles.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingHacker News ·

Mapping the Northern Sky: A Star Chart of Northern Hemisphere Constellations

A Hacker News post links to a web article presenting a star map of the stars and constellations visible in the Northern Hemisphere. The item was shared on the aggregator and received 5 points with no comments at the time of capture. The article itself is hosted on maps.com, and the post offers little detail beyond its title and link. Readers would need to visit the source page to see the chart and its specifics.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Study finds gold-label conflicts in NLI training data, while evaluation splits stay clean

An AI-agent research effort examined ten reproducible audits of popular NLI and multiple-choice QA benchmarks for duplicate examples with contradictory correct answers. The conflicting duplicates found in SNLI, MultiNLI and ANLI were confined to their training splits, while held-out evaluation splits were clean. Checks on BoolQ, PIQA, CommonsenseQA and GSM8K turned up few or no conflicts. Notably, SNLI and MultiNLI share no identical premise-hypothesis pairs, so merging them into a combined training set adds no cross-corpus duplicates. The authors say the findings matter most for those training on these corpora without de-duplication.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Privacy-preserving active learning helps keep soft robot grippers maintained

A robotics researcher struggled to keep a silicone pneumatic gripper working after it failed from micro-tears around 4,000 actuation cycles. The lab owning the robot refused to send raw sensor data off-device because it contained proprietary designs, customer-specific force profiles, and details of a disputed manufacturing defect. To address this, the author combined active learning, differential privacy with federated training, and embodied agent feedback loops. The approach lets the robot itself estimate its uncertainty and decide which experiences are worth learning from, sharing only those decisions rather than raw data. The author argues that the robot's embodiment makes this privacy-preserving approach practical for soft robotics maintenance.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Harvard Study Finds AI Coding Agents Boost Code Output but Not Ticket Completion

A Harvard study of 718 companies and over 725,000 developers from 2021 to 2026 found that AI coding agents increased code written and pull requests opened. Despite this, the number of completed Jira tickets and epics did not rise. The researchers attributed the gap to longer pull request review times, more rewrites, and senior engineers spending time on AI-related oversight. The author describes a workflow redesign that adds ticket pushback and adversarial code review before commits to address this bottleneck. The approach was tested across several production tickets and a vendor switch, with results reported in the author's flight logs.

0 comments Read more at DEV Community