A Bad Day to Use Python
- https://www.youtube.com/watch?v=mx3g7XoPVNQ
- Original title: A bad day to use python
ThePrimeagen recounts, with escalating disbelief, the compromise of LiteLLM (a unifying proxy layer for many different LLM APIs) — a Python package downloaded 97 million times a month whose GitHub repo owner got hacked, letting attackers ship a malicious release that exfiltrates SSH keys, cloud credentials, Kubernetes configs, database passwords, crypto wallets, and more from any machine that merely starts a Python process.
The hack
The malicious LiteLLM release abused Python's .pth file mechanism: code in a .pth file runs automatically whenever the Python interpreter starts. On startup it harvested local credentials, double-base64-encoded them (called out as a classic hacker signature), and exfiltrated them to an attacker server. Because LiteLLM can arrive as a transitive dependency (e.g. pulled in by an MCP plugin inside Cursor), victims didn't need to install it directly to be compromised.
The "vibe coding" angle
Andrej Karpathy claimed vibe coding was why the hack failed for some users — unconfirmed, but the person who actually surfaced the vulnerability (Callum McManaman) found it because a buggy version of the .pth payload spawned itself repeatedly, fork-bombing his machine and crashing it from lack of RAM, but only when run via an MCP server. Prime jokes this makes vibe coding the accidental hero. He also plugs the argument that package managers are inherently risky (link to the essay in the video description).
Suppressing the disclosure
When McManaman opened a GitHub issue about the vulnerability, the repo was flooded with hundreds of near-identical AI-bot replies ("Great explanation, thanks for sharing") that buried the real discussion and made it hard to tell the issue was serious. The issue was ultimately closed as "not planned" in the middle of the spam, suggesting the repo owner's account was compromised almost immediately after disclosure. Prime notes this bot-flooding tactic is a novel and effective way to add friction and stall a coordinated response.
The Delve twist
The final twist: the LiteLLM website displayed SOC 2 Type I / ISO 27001 compliance badges "secured by Delve," an AI-native compliance company that is separately being accused (per a TechCrunch report linked in the description) of misleading customers with fake compliance reports. Both LiteLLM and Delve are Y Combinator-backed companies, which Prime finds darkly funny given the circumstances — if the Delve allegations hold up, LiteLLM's compliance certification itself may not be legitimate.
Scale of the damage
Citing contact with the threat actor behind a second, related attack in the same ecosystem (tied to the Trivy project), Prime reports the attackers claim to have obtained 300GB of compressed credentials, are actively extorting multiple multi-billion dollar companies, and that the LiteLLM compromise alone yielded roughly half a million stolen credentials. Their stated message: "Team PCP is here to stay. Long live the supply chain."
Takeaway
Anyone using LiteLLM, or any package that depends on it, should rotate all credentials immediately — SSH keys, cloud provider creds, Kubernetes configs, database passwords, .env files, and more. Prime closes with his usual dig at Python (undercut by acknowledging he mostly uses TypeScript himself), followed by a boot.dev sponsor plug.