litellm - 💡(How to fix) Fix [Security]: CRITICAL: Malicious litellm_init.pth in litellm 1.82.8, 1.82.7 — credential stealer via PyPI supply chain [1 comments, 2 participants]

Fix Plan

The fix involves updating dependencies and securing the Maintainer Account.

• Remove access to the compromised Maintainer Account
• Create a new Maintainer Account with secure credentials
• Update dependencies in the litellm project:

# Update pip dependencies
pip install --upgrade -r requirements.txt

# Update npm dependencies (if applicable)
npm update

• Verify the litellm project's configuration files (e.g., config.json, settings.py) to ensure the new Maintainer Account credentials are used.

Verification

To verify the fix:

1. Check the GitHub issue tracker for updates on issue #24512.
2. Test the litellm project with the updated dependencies and new Maintainer Account credentials.
3. Monitor the project's build and deployment logs for any errors or security warnings.

Extra Tips

• Regularly review and update dependencies to prevent similar issues.
• Implement two-factor authentication (2FA) for all Maintainer Accounts.
• Use a secrets manager to securely store sensitive credentials.