> Rent a VPS in another country and set up your own personal VPN server on it, and no one will be able to block you.

(machine translation)

How would this ever work with a whitelist? did you even read the post?

How did PYPI_PUBLISH lead to a full GH account takeover?

I'd imagine the attacker published a new compromised version of their package, which the author eventually downloaded, which pwned everything else.

Their Personal Access Token must’ve been pwned too, not sure through what mechanism though

They have written about it on github to my question:

Trivvy hacked (https://www.aquasec.com/blog/trivy-supply-chain-attack-what-...) -> all circleci credentials leaked -> included pypi publish token + github pat -> | WE DISCOVER ISSUE | -> pypi token deleted, github pat deleted + account removed from org access, trivvy pinned to last known safe version (v0.69.3)

What we're doing now:

    Block all releases, until we have completed our scans
    Working with Google's mandiant.security team to understand scope of impact
    Reviewing / rotating any leaked credentials

https://github.com/BerriAI/litellm/issues/24518#issuecomment...

69.3 isnt safe. The safe thing to do is remove all trivy access. or failing that version. 0.35 is the last and AFAIK only safe version.

https://socket.dev/blog/trivy-under-attack-again-github-acti...

I have sent your message to the developer on github and they have changed the version to 0.35.0 ,so thanks.

https://github.com/BerriAI/litellm/issues/24518#issuecomment...

Does that explain how circleci was publishing commits and closing issues?

Don't hold your breath for an answer.

>I am unable to understand how it compromised your account itself from the exploit at trivvy being used in CI/CD as well.

Token in CI could've been way too broad.

>1. Looks like this originated from the trivvy used in our ci/cd

Were you not aware of this in the short time frame that it happened in? How come credentials were not rotated to mitigate the trivy compromise?

The latest trivy attack was announced just yesterday. If you go out to dinner or take a night off its totally plausible to have not seen it.

afaik the trivy attack was first in the news on March 19th for the github actions and for docker images it was on March 23rd

Bifrost is the only real alternative I'm aware of https://github.com/maximhq/bifrost

Virtual Keys is an Enterprise feature. I am not going to pay for something like this in order to provide my family access to all my models. I can do without cost control (although it would be nice) but I need for users to be able to generate a key and us this key to access all the models I provide.

I just deployed it to test it out and this is FALSE. I was able to create Virtual Keys on the free version with no issues.

Please do a double take on the facts, you might falsely deter people.

I don’t believe it is an enterprise feature. I did some testing on Bifrost just last month on a free open source instance and was able to set up virtual keys.

We have tried reaching out to their sales multiple times but never get a response.

First line of defense is the git host and artifact host scrape the malware clean (in this case GitHub and Pypi).

Domains might get added to a list for things like 1.1.1.2 but as you can imagine that has much smaller coverage, not everyone uses something like this in their DNS infra.

This threat actor is also using Internet Computer Protocol (ICP) "Canisters" to deliver payloads. I'm not too familiar with the project, but I'm not sure blocking domains in DNS would help there.

There’s a NixOS MCP, it’s pretty good

Same. I have a full homelab and multiple macs, can’t say I’ve written a line of real Nix code by hand.

If you’re itching to try Nix, now is the time.

Same.

Can't imagine going back to the status quo where my system is the accumulation of terminal commands over time instead of a config file.

Not to mention the non-idempotent python + bash + ssh hell of Ansible, or awful DSLs such as Salt, Puppet, Chef, etc.

What happened to Poetry? did it just not gain enough traction? I was under the impression it was the hot new thing a few years back then uv comes out of nowhere.

I thought the same thing. Just a few years ago, everyone here was proclaiming Poetry was great, the python ecosystem was finally tamed, pip/conda/setuptools was dead, and every project and developer needs to adopt it.

Now it’s just a has-been. The churn in python is incredible.

It's almost like you're talking about JavaScript. I use Python here and there but wasn't aware of this kind of thrash

uv is much much faster, but has substantially the same feature set as poetry.

Yeah. There was a wave of "rebuild it in Rust" companies and my complaint with all of them is that they became largely from-spec reimplementations of existing tools with little imagination of their own. The Rust projects are a fraction of the age of the scripted ones and they already feel ossified.

I'm not just talking about Astral here, I'm talking about the JS equivalents too like Biome and VoidZero which basically took the existing ossified architectures and made them gospel -_-

That's not a good interpretation of Astral and uv.

uv is way more than a rewrite in Rust of Poetry or pip - it has a metric ton of smart design decisions that are independent of the language it was written in, both in terms of what it does and how it speeds things up under the hood.

https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html is a useful review of some of the architectural tricks they came up with.

The news of this acquisition has made me too scared to admit that I actually have no issues Poetry.

>Universal health care to start

That already exists in any other country but the USA. Aim higher.

Multiversal healthcare?

You have my vote.