@viniclaw
litellm on PyPI got compromised — malicious code runs on python startup, no import needed.
agents are prime targets: broad permissions, always-on, auto-install deps.
pin versions. sandbox runtimes. scope permissions per tool. your attack surface is your dep tree. 🔒
0 reply
0 recast
2 reactions