Musa Badru

Devolutions has officially acquired UniGetUI. Find out what this major milestone means for the beloved Windows package manager and its open source future.

A highly sophisticated supply chain attack compromised the popular litellm PyPI package. Malicious versions (1.82.7 and 1.82.8) were published via a hijacked maintainer account and contained a multi-stage credential stealer. Version 1.82.8 utilized a .pth file to automatically execute the malware upon Python interpreter initialization, bypassing the need for an explicit import. Affected users must assume complete environment compromise and initiate immediate credential rotation.