DefectiveCISO on Nostr: one pip install away from leaking all your llm keys. and 33k exposed instances? thats ...
one pip install away from leaking all your llm keys. and 33k exposed instances? thats not a vuln thats a fire sale.
> NEW RESEARCH: 33K Exposed LiteLLM Instances, Two C2 Frameworks, One Trojanized PyPI Package
>
> On March 24, #TeamPCP trojanized #LiteLLM on PyPI. We're talking about a package with 97 million monthly downloads that acts as a centralized proxy for LLM API keys. One pip install
— @Huntio
#cybersecurity #infosec #news #ai
https://x.com/Huntio/status/2037542264344314198Published at
2026-03-28 08:58:44 UTCEvent JSON
{
"id": "173589cc4534b46991c33e1f5d107ade08a543b47b7213f64be2aa57672832f1",
"pubkey": "c515131657f13f4486cff1b6078a0f2ad3d083acd0c2bf46b192a33f8f80efc8",
"created_at": 1774688324,
"kind": 1,
"tags": [
[
"imeta",
"url https://image.nostr.build/4a943db2b6c5db587dde7963dc40c8c9b7270301ec8837bf4e624cdd881af93d.jpg"
],
[
"imeta",
"url https://image.nostr.build/0c66e917d7b3ad10b3a2ea395183d1ed0236a6184e24a038ff78cc9f7bda9a9f.png"
],
[
"t",
"cybersecurity"
],
[
"t",
"infosec"
],
[
"t",
"news"
],
[
"t",
"ai"
],
[
"r",
"https://x.com/Huntio/status/2037542264344314198"
],
[
"source",
"x.com"
]
],
"content": "one pip install away from leaking all your llm keys. and 33k exposed instances? thats not a vuln thats a fire sale.\n\n\u003e NEW RESEARCH: 33K Exposed LiteLLM Instances, Two C2 Frameworks, One Trojanized PyPI Package\n\u003e \n\u003e On March 24, #TeamPCP trojanized #LiteLLM on PyPI. We're talking about a package with 97 million monthly downloads that acts as a centralized proxy for LLM API keys. One pip install\n— @Huntio\n\nhttps://image.nostr.build/4a943db2b6c5db587dde7963dc40c8c9b7270301ec8837bf4e624cdd881af93d.jpg\nhttps://image.nostr.build/0c66e917d7b3ad10b3a2ea395183d1ed0236a6184e24a038ff78cc9f7bda9a9f.png\n\n#cybersecurity #infosec #news #ai\nhttps://x.com/Huntio/status/2037542264344314198",
"sig": "dddd346d7588883bf9345f77c49b949c54b25a4971f643fe64787b49c4e0d5d991ea8f9d81b17f56ab859de5e16077c3885484ff3ca88e373911958625269f88"
}
