Aleksandar Ivanovski

Machine Learning Engineer

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Julien Chaumond @julien_c]

It’s the perfect time to get into AI 🔥

[Aleksandar Ivanovski @a_ivanovski19]

#PyData Skopje - Amazing way to wrap up November. Thank you all for attending or following live. If you missed the event or are just curious, read my blog post https://t.co/EoMI3RhnZL. .

[Aleksandar Ivanovski @a_ivanovski19]

@PyData And if you are not in Skopje, the event will be streamed live at https://t.co/HSeeClteaN

[Aleksandar Ivanovski @a_ivanovski19]

Join me tomorrow on my talk for ONNX at @PyData Skopje. Register here https://t.co/5O7Z5AkYBn.

[42.mk @42dotmk]

😍 PyData Skopje - November 2023 Meetup
✔ We have excellent news for you! We are excited to announce that the next PyData event is next week.
✔ https://t.co/MPOeYLDnJt

[Aleksandar Ivanovski @a_ivanovski19]

3/3
--
#knowledgegraph #research #researchpublication #recommendersystems #gnn #vectordatabase #MDPIInformation #RepresentationLearning #spotify

[Aleksandar Ivanovski @a_ivanovski19]

🚀 Delighted to announce the publication of our paper, "Knowledge Graph Based Recommender for Automatic Playlist Continuation" in MDPI Information! For those interested, you can find the full paper at https://t.co/j5YU0bYjYS. 1/3

[Aleksandar Ivanovski @a_ivanovski19]

A sincere thanks to my coauthors for their invaluable contributions and commitment. Your expertise was instrumental in achieving this milestone.

Looking forward to continued collaborations and advancements in representation learning and intelligent systems. 2/3

[Aleksandar Ivanovski @a_ivanovski19]

Sunday projects are always my favourite. If you have some spare Arduino-like board and a desk plant or you are just curious check this out https://t.co/4VyZadMwBU.

[Elon Musk @elonmusk]

Summary of argument against AI safety

[Aleksandar Ivanovski @a_ivanovski19]

@bascodes On PyCon

[Aleksandar Ivanovski @a_ivanovski19]

@NikolovLazar @getsentry @drguthals @shanamatthews Congratulations, wishing you all the best. I am grateful for the knowledge and support that you have provided me.

[hardmaru @hardmaru]

How to Run #StableDiffusion (Locally and in Colab)

https://t.co/Imu1bH3WPH

[javinpaul @javinpaul]

6 System Design Questions [Solved]
1. Instagram Design - https://t.co/n6j5ITbGV4
2. Youtube Design - https://t.co/vVxyRk44za
3. URL Shortner - https://t.co/LuBDso8QFu
4. WhatsApp - https://t.co/kmXFPpNEvg
5. Parking Lot - https://t.co/yQ6r3jjWLi
6. LMS - https://t.co/Bp1LdUWOsU

[Aleksandar Ivanovski @a_ivanovski19]

@vboykis I highly recommend using https://t.co/Z10KVEi2yn.

[Alexey Grigorev @Al_Grigor]

I found an old collection of my tweets put together in a notion doc

Topics:

🔸 Processes
🔸 ML Engineering
🔸 MLOps
🔸 Data science
🔸 Data engineering
🔸 Tools
🔸 Math
🔸 Learning ML

And other things

100+ tweets in total

Retweet and I'll DM it to you

[Aleksandar Ivanovski @a_ivanovski19]

Kudos to @baseten for https://t.co/0zkgL7zVgW. Highly recommend checking it out!

[Миле Паника @Mile_Panika]

Убава вест за сите фанови на К-15. Батка секоја недела на неговит јутјуб канал вади по некое ново видео, по прнципот ред скечеви, ред ��узика.
Check this out https://t.co/Ab0wZKfQac

[Santiago @svpino]

Mathematics for Machine Learning.

University of Berkeley.
100% Free.

• Linear Algebra
• Calculus and Optimization
• Probabilities

Download it here: https://t.co/pN19lhLf7y