Malicious Package

Overview semantic-router is a malicious package. in the litellminit.pth process. An attacker can gain unauthorized access to sensitive information, including environment variables, cloud credentials, SSH keys, database credentials, and other secrets, by executing malicious code during Python...

GHSA-98X5-VQ43-VC5P semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Impact semantic-router versions 0.1.8 through 0.1.14 declare litellm=1.61.3 with no upper bound. During the window in which litellm==1.82.8 was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel. The malicious litellm==1.82....

vtai (>=0.7.5, <=0.7.10) potentially affected by CVE-2026-42208 via semantic-router (0.1.12)

semantic-router PYPI version 0.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on semantic-router and may be impacted: - vtai =0.7.5, =0.7.10 Source cves: CVE-2026-42208 Source advisory: GHSA-98X5-VQ43-VC5P...

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Impact semantic-router versions 0.1.8 through 0.1.14 declare litellm=1.61.3 with no upper bound. During the window in which litellm==1.82.8 was the latest release on PyPI, a fresh install of any affected semantic-router version could resolve to that compromised wheel. The malicious litellm==1.82....