On Monday, I was the first to discover the LiteLLM supply chain attack. After identifying the malicious payload, I reported it to PyPI’s security team, who credited my report and quarantined the package within hours. On restart, I asked Claude Code to investigate suspicious base64 processes and it told me they were its own saying something about “standard encoding for escape sequences in inline Python.” It was technical enough that I almost stopped looking, but I didn’t, and that’s the only reason I discovered the attack. Claude eventually found the actual malware, but only after I pushed back. I also found out that Cursor auto-loaded a deprecated MCP server on startup, which triggered uvx to pull the compromised litellm version published ~20 minutes earlier, despite me never asking it to install anything. Full post-mortem: https://futuresearch.ai/blog/no-prompt-injection-required/ submitted by /u/they_will
Originally posted by u/they_will on r/ClaudeCode