Krupa Sagar

Technology Geek | Sports Lover | Fascinated about Universe, Space Science and Robotics

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Krupa Sagar @hbksagar]

@sankalpa728 When did you last use Samsung? UI has improved and is better than the most!

[Royal Challengers Bengaluru @RCBTweets]

Ee Sala Cup N̶a̶m̶d̶e̶ Namdu! 🏆🥹

[Krupa Sagar @hbksagar]

RCB! RCB! RCB! Finally, the wait is over! Great team performance this season!

[Shreedhar @shreedharshetty]

Yield Tokenization is the missing DeFi puzzle piece.

Amongst all the innovative ideas DeFi has brought to life, this is one of the most transformative.

It creates future value, turning projected returns into tradable assets. It’s the redefinition of liquidity, where rewards isn't something you wait for but something you actively leverage.

It’s a shift in how we perceive value itself, paving the way for a defi landscape that’s as forward-looking as it is dynamic.

[Krupa Sagar @hbksagar]

@SwiggyCares Sent via DM

[Krupa Sagar @hbksagar]

@SwiggyCares Looks like the bot doesn't understand the context. Please go through the thread if you have time.

[Krupa Sagar @hbksagar]

Not only did I pay full retail price plus an additional platform fee to receive a near-expired product, but your team also has the audacity to claim it's ‘all good.’ This lack of accountability is unacceptable.

[Krupa Sagar @hbksagar]

This lack of quality control and customer care has lost you a loyal customer. Swiggy needs to step up its game and put customer satisfaction first, not just empty apologies. Let this be a warning for others. #ConsumerRights #CustomerExperience #SwiggyInstamart

[Lorenz Lehmann @LehmannLorenz]

Today, my PC was nearly compromised.

With just one click, I installed a malicious @code extension. Luckily, I was saved as my PC doesn't run on Windows.

Hackers are getting smarter and aren't just targeting beginners. Here's how they do it and how you can protect your coins!

[Novastro 2.0 🔜 @Novastro_xyz]

🔥We're super stoked to launch our testnet on @arbitrum Orbit,marking a significant milestone in our journey!

This integration with Arbitrum 💙,🧡highlights our commitment to leveraging advanced blockchain technology to deliver scalable & secure solutions as a Layer 3 chain.

[Krupa Sagar @hbksagar]

@Uber_India I am getting more and more bad experiences every time with #UberGo as per your companies guidelines, every car Go Taxi should have an AC. There is no direct way to connect with customer care as well. #horrible

[Sudeepa Kolli @i_sudeepa]

Two Indian students in Connecticut found dead in their sleep due to carbon monoxide exposure.

For students abroad, please read:

[Aditya Singh @cryptoady]

2 years ago we started a petition - urging the GOI to reconsider & change harsh crypto tax rules like :

Flat 30% tax, 1 TDS & No loss set off

If they are not changed, it will result in talent & capital outflow to foreign exchanges.

2 years down the line, negative impact of these crypto tax laws are clearly visible.

That’s why would like to urge the Government again to reconsider & change these harsh crypto tax rules.

Below is our petition, which currently has over 100K sign ups, you can do Gn it if you agree.

Also Like retweet and share as much you can it will help.

Also if anyone wants to help with data, how current crypto tax rules are hurting crypto innovation in India & Indian users. Pls DM me.

https://t.co/vJK321CU3R

[Krupa Sagar @hbksagar]

Marvelous job, @isro! Congratulations to 🇮🇳 and the 🌎

[ISRO @isro]

Chandrayaan-3 Mission:
'India🇮🇳,
I reached my destination
and you too!'
: Chandrayaan-3

Chandrayaan-3 has successfully
soft-landed on the moon 🌖!.

Congratulations, India🇮🇳!

#Chandrayaan_3
#Ch3

[Krupa Sagar @hbksagar]

@Airtel_Presence @Airtel_Presence @airtelindia Don't post the same answer. Answer Query and let's continue to conversation in the public forum. When did I Subscribe to your International Usage and why I was not informed before charging such exuberant prices?

[Krupa Sagar @hbksagar]

@airtelindia @Airtel_Presence Stop looting people with the name of convenience.

[Krupa Sagar @hbksagar]

@Airtel_Presence As informed, you are stating without my concent you can enable any package and I have to pay for it. How is that legal? And you expect me to agree with you.

[Krupa Sagar @hbksagar]

@bijendrakr He he absolutely! Most of them are to increase their reach but some of them are useful.