No
uvx automatically pulled latest litellm (version unpinned) and built the environment. Then Cursor started up the local MCP server automatically on load
ddp26 on Hacker News
In the thread “Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised”, replying to this comment
Got in the way: Unpinned version and automatic MCP server startup led to compromise.
… One thing not in that writeup is that very little action was needed for my engineer to get pwnd. uvx automatically pulled latest litellm (version unpinned) and built the environment. Then Cursor started up the local MCP server automatically on load.