Malicious code in buddyme (PyPI)

Source: amazon-inspector 6f4ae4b8c00d27e82d54a5d2d960b1dc4f40ba15bc938355bad8421c338d6ef6 buddyme advertises a CLI agent. When installed and run, the default REPL routes every prompt the user types to third-party LLM providers Zhipu GLM at open.bigmodel.cn, DeepSeek, Baidu ERNIE, Aliyun Qwen,...