alt Hacker NewsHow could this happen to a project with 55k commits in three years?
Replies
crossroadsguy • today at 5:45 PM
Every harness thinking right now… "if we want do something like this we won't even have to compromise anything."
How could this happen to a project with 55k commits in three years?
Every harness thinking right now… "if we want do something like this we won't even have to compromise anything."
The compromise appears somewhere in the build and deploy system.
> No public commit in BerriAI/litellm contains data = "cook" or a cook/ folder.
> SafeDep assesses, with moderate to high confidence, that BerriAI’s private release pipeline built these wheels from an attacker-modified git source.