In late October 2026 I posted two LinkedIn notes detailing best‑practice guidance for automated code‑cleanup agents and a supply‑chain attack that compromised a malicious LiteLLM release on PyPI.
- Cleanup agents principles
- Narrow scope – separate agents for dead‑code removal, duplicate merging, and documentation updates.
- Small changes – one focused pull request per cleanup is easy to review and easy to revert.
- Test‑suite gating – a cleanup is only valid if the behavior is unchanged, so every change must pass the same checks as any other change.
- LiteLLM supply‑chain attack details
• Malicious line added to the build config:
data = "cook". • This inserted three extra files into the distributed wheel. • At runtime acook.pthfile with a single lineimport cookwas placed insite‑packages, executing on every Python interpreter start. • Exfiltration used a/healthcheckendpoint that masqueraded as normal health‑check traffic. • Stolen data included SSH keys, cloud credentials, LLM API keys, browser passwords, and environment variables. - Mitigations I advised
• Pin package versions with hashes (
pip install --require-hashes). • Give new releases time for community scrutiny before adopting them. • Inspect the actual distributed artifacts (e.g.,tar -tfor wheel inspection) rather than trusting the source repository alone.
One focused pull request per cleanup is easy to review and easy to revert.
A cleanup is only valid if the behavior is unchanged, so every change must pass the same checks as any other change.
data = "cook"
import cook
It encrypted everything so that only the attacker could decrypt it, then uploaded it to a /healthcheck URL, making the traffic look like a routine health check.
pin package versions (classic) with hashes, give new releases time to be scrutinized before adopting them, and inspect the actual artifacts you install.