📄 中文摘要
通过使用 BigQuery PyPI 数据集，Daniel Hnyk 确定了在 LiteLLM 被利用的 46 分钟内，该恶意软件包的下载量达到了 47,000 次。此外，研究还发现有 2,337 个依赖于 LiteLLM 的软件包，其中 88% 的软件包未能以有效的方式固定版本，从而避免了被利用的版本。这一事件凸显了软件包管理中版本控制的重要性，以及开发者在使用第三方库时需保持警惕。
LiteLLM 黑客事件：你是 47,000 名受害者之一吗？
出处: LiteLLM Hack: Were You One of the 47,000?
发布: 2026年3月25日
📄 English Summary
LiteLLM Hack: Were You One of the 47,000?
Using the BigQuery PyPI dataset, Daniel Hnyk determined that the exploited LiteLLM packages were downloaded 47,000 times during the 46 minutes they were active on PyPI. Additionally, 2,337 packages that depended on LiteLLM were identified, with 88% of them failing to pin versions in a way that would have prevented the exploitation. This incident highlights the importance of version control in package management and the need for developers to remain vigilant when using third-party libraries.