News for hackers. Stuff that matters.

A comment on LiteLLM Python package compromised by supply-chain attack. Parent comment

Re:LiteLLM Python package compromised by supply-chain attack by jFriedensreich on Tuesday March 24, 2026 @10:26AM (#47503095)
Containers can mean many things, if you mean plain docker default configured containers then no, they are a packaging mechanism not safe environment by themselves.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by wswin on Tuesday March 24, 2026 @10:29AM (#47503133)
They don't have access to the host filesystem nor environment variables and this attack wouldn't work.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by jFriedensreich on Tuesday March 24, 2026 @12:49PM (#47505591)
Just because this attack example did not contain container escape exploits does not mean this is safe. Its better than nothing but nothing that will save us.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by lyu07282 on Wednesday March 25, 2026 @02:53AM (#47514136)
Those supply chain attacks we are seeing are bad, but if someone burns a 0day container escape for it, it would probably be a net positive effect on security ironically. Just saying this is FUD.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by jFriedensreich on Wednesday March 25, 2026 @04:28PM (#47522729)
FUD is crypto and tech bro speech. Using containers without vm, gvisor or similar is just irresponsible.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by lyu07282 on Wednesday March 25, 2026 @05:05PM (#47523245)
Oh you are young, FUD was criticism to IBM sales people scaring customers away from PC compatible clones.
[ Parent | on HN ]