Unverified50% confidenceFactExact time

由于 .pth 载荷在 import 之前执行，Bandit 等静态分析工具和基于 import hook 的运行时监控方案难以捕获此类攻击

1

Sources

50%

Confidence

Long-term

Relevance

8/21/2026

First Seen

Sources

LiteLLM Supply Chain Poisoning Incident: A Deep Dive into 40 Minutes of Full-Stack Credential Theft

Related Claims

Unverified此前 ua-parser-js、coa、rc 等包的供应链攻击中已多次观察到类似的凭证外泄模式61% similar Unverified智能体供应链风险主要发生在运行时动态加载有漏洞的组件，使传统的'一次扫描、持续信任'模式失效59% similar Unverified在补丁尚未就绪时披露漏洞细节可能为攻击者提供现成的武器58% similar

Cite This Claim

Stable URI

https://kongchang.com/claim/782702

API

curl https://kongchang.com/api/v1/knowledge/claims/782702

MCP

get_claim(id=782702)