If anyone thinks supply chain attacks are only an npm or JS problem, here’s an example from the Python and LLM world.
A single `pip install litellm` and all your access keys are stolen.
Start thinking about systemic defense against supply chain attacks before it's too late.
https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/
Supply chain attack protection:
1. Version lockfiles and during update use versions that are more than 24 hours old
2. Dev Container for developer’s machine isolation
3. Split CI into jobs with different permissions and install dependencies only in some
4. Minimize dependencies (write small ones ourselves, choose dependencies based on the number of sub-dependencies)
Andrey Sitnik