Vulnerability	Vulnerable Version
C Malicious Package semantic-router is a malicious package. in the `litellm_init.pth` process. An attacker can gain unauthorized access to sensitive information, including environment variables, cloud credentials, SSH keys, database credentials, and other secrets, by executing malicious code during Python interpreter startup without requiring an import. The collected data is encrypted and exfiltrated to an external server. This is only exploitable if a fresh installation occurred during the period when the compromised dependency version was available on the package repository. How to fix Malicious Package? Upgrade `semantic-router` to version 0.1.15 or higher.	[0.1.8,0.1.15)

Malicious Package

semantic-router is a malicious package. in the litellm_init.pth process. An attacker can gain unauthorized access to sensitive information, including environment variables, cloud credentials, SSH keys, database credentials, and other secrets, by executing malicious code during Python interpreter startup without requiring an import. The collected data is encrypted and exfiltrated to an external server. This is only exploitable if a fresh installation occurred during the period when the compromised dependency version was available on the package repository.

How to fix Malicious Package?

Upgrade semantic-router to version 0.1.15 or higher.

[0.1.8,0.1.15)

Go back to all versions of this package