Sean Scott
@oraclesean.com
1.9K followers 2.9K following 3.4K posts
Your database is down because you didn't listen to me. I put databases in containers so I can cook, buy knives, run & give dogs the life they deserve. He/him. Backup≠Recovery. Dogs>People. Trans Rights=Human Rights.
![What actually happened
The root cause was mundane. MCP clients like Cursor, Claude Code and others are using (local) MCP servers via some "executor" tool such as uvx for Python or npx for Node.js. When you run an MCP via uvx, it automatically downloads dependencies of that MCP and runs the given command. Unfortunately, our (mostly deprecated) MCP server had an unpinned dependency of a litellm package. When my Cursor IDE tried to autoload the MCP server, uvx stepped in to download that latest litellm version, which was malware uploaded to PyPI by hackers just minutes earlier. The seamless ergonomics of uvx meant I became one of the lucky beta testers of the freshly released malware.
A sloppy, likely vibe-coded mistake in the actual malware implementation led it to turn into a fork bomb. It installs a file called litellm_init.pth in site-packages. Python automatically executes .pth files on every interpreter startup. The first thing it does is:
```
subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode(...))"])
```
That child Python process also triggers litellm_init.pth, since it's still in site-packages, which spawns another child, which spawns another. Thus leading to the only sign I would have noticed that the malware was running.
As Andrej Karpathy pointed out on X, without this error it would have gone unnoticed for much longer. The malware's own poor quality is what made it visible.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:urarilre5xm4hmwzaizongcs/bafkreicotatbltxm2goatbuxui7tecuxzovq3fblyei6z4xkrnmpiijiva)
![A graph of daily Starlink satellite reentries. The x axis goes from 2018 to the present. The y axis is 0 to 3+. There is a small spike in activity in late 2020, another larger one in early 2022, then things calm down before spiking again in early 2024, which continues to rise.
From the accompanying article at space weather.com:
'UNPRECEDENTED' STARLINK REENTRIES: What goes up, must come down--which could be a problem when you're launching thousands of satellites. Since 2018, SpaceX has placed more than 7,000 Starlink satellites into Earth orbit, and now they are starting to come down. In January alone, more than 120 Starlinks deorbited, creating a shower of fireballs.
"The sustained rate of daily reentries is unprecedented," says Jonathan McDowell, an astronomer at the Harvard Center for Astrophysics who tracks satellites. "They are retiring and incinerating about 4 or 5 Starlinks every day."
Planners have long known this would happen. First generation (Gen1) Starlink satellites are being retired to make way for newer models. "More than 500 of the 4700 Gen1 Starlinks have now reentered," says McDowell.
When Starlinks reenter, they disintegrate before hitting the ground, adding metallic vapors to the atmosphere. A study published in 2023 found evidence of the lingering devris. In February 2023, NASA flew a WB-57 aircraft 60,000 feet over Alaska to collect aerosols. 10% of the particles contained aluminum and other metals from the "burn-up" of satellites.
Right: NASA's WB-57 high altitude airplane. [more]
What we're observing is a giant uncontrolled experiment in atmospheric chemistry. The demise of just one Gen1 Starlink satellite produces about 30 kilograms (66 pounds) of aluminum oxide, a compound that eats away at the ozone layer. A new study finds these oxides have increased 8-fold between 2016 and 2022, and the recent surge is increasing the pollution even more.
On the bright side, each reentry produces a beautiful fireball--and the odds are increasing tha…](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:urarilre5xm4hmwzaizongcs/bafkreihpekv55jyxkukbxeedv6vsrxiiklsgaqtubn7arek5syvphwchii)
