Settings

LiteLLM was recently victim of a supply-chain exploit, where an attacker was able to run arbitrary code on infected machines. In the aftermath, I saw how uv provides a safety setting for this, and it would be good practice to add this to your pyproject.toml [tool.uv] exclude-newer = "1 week" or uv.toml: exclude-newer = "1 week" The docs provide multiple options to protect yourself.

Set up your GitHub Actions workflow with a specific version of https://docs.astral.sh/uv/ - astral-sh/setup-uv

Get actionable best practices to shrink your attack surface, protect execution environments, control package ingestion, and catch compromises early.

A guide to configuring dependency cooldowns across package managers to protect against supply chain attacks.