News for hackers. Stuff that matters.

A comment on LiteLLM Python package compromised by supply-chain attack. Parent comment

Re:LiteLLM Python package compromised by supply-chain attack by redrove on Tuesday March 24, 2026 @10:11AM (#47502890)
>1. Looks like this originated from the trivvy used in our ci/cd

Were you not aware of this in the short time frame that it happened in? How come credentials were not rotated to mitigate the trivy compromise?

[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by wheelerwj on Tuesday March 24, 2026 @12:30PM (#47505236)
The latest trivy attack was announced just yesterday. If you go out to dinner or take a night off its totally plausible to have not seen it.
[ Parent | on HN ]
[dead]
Re:LiteLLM Python package compromised by supply-chain attack by embedding-shape on Tuesday March 24, 2026 @12:37PM (#47505372)
Probably more "serious human" than "serious over-capitalist" or "seriously overworked". Good for them.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by anishgupta on Tuesday March 24, 2026 @11:07PM (#47512754)
afaik the trivy attack was first in the news on March 19th for the github actions and for docker images it was on March 23rd
[ Parent | on HN ]