LiteLLM Python package compromised by supply-chain attack

Re:LiteLLM Python package compromised by supply-chain attack by dotancohen on Tuesday March 24, 2026 @10:49AM (#47503450)

  > We just can't trust dependencies and dev setups.

In one of my vibe coded personal projects (Python and Rust project) I'm actually getting rid of most dependencies and vibe coding replacements that do just what I need. I think that we'll see far fewer dependencies in future projects.

Also, I typically only update dependencies when either an exploit is known in the current version or I need a feature present in a later version - and even then not to the absolute latest version if possible. I do this for all my projects under the many eyes principal. Finding exploits takes time, new updates are riskier than slightly-stale versions.

Though, if I'm filing a bug with a project, I do test and file against the latest version.

[ Parent | on HN ]

Re:LiteLLM Python package compromised by supply-chain attack by adw on Tuesday March 24, 2026 @11:09AM (#47503814)

> In one of my vibe coded personal projects (Python and Rust project) I'm actually getting rid of most dependencies and vibe coding replacements that do just what I need. I think that we'll see far fewer dependencies in future projects.

No free lunch. LLMs are capable of writing exploitable code and you don’t get notifications (in the eg Dependabot sense, though it has its own problems) without audits.

[ Parent | on HN ]

Re:LiteLLM Python package compromised by supply-chain attack by dotancohen on Tuesday March 24, 2026 @01:45PM (#47506465)

My vibe coded personal projects don't have the source code available for attackers to target specifically.

[ Parent | on HN ]

Re:LiteLLM Python package compromised by supply-chain attack by nimih on Tuesday March 24, 2026 @02:56PM (#47507464)

It might surprise you to learn that a large number of software exploits are written without the attacker having direct access to the program's source code. In fact, shocking as it may seem today, huge numbers of computers running the Windows operating system and Internet Explorer were compromised without the attackers ever having access to the source code of either.

[ Parent | on HN ]

Re:LiteLLM Python package compromised by supply-chain attack by sersi on Wednesday March 25, 2026 @04:37AM (#47514791)

I'm actually curious if the windows source code leak of 2004 increased the number of exploits against windows? I'm not sure if it included internet explorer. I remember that windows 2000 was included back then.

[ Parent | on HN ]

Re:LiteLLM Python package compromised by supply-chain attack by heavyset_go on Tuesday March 24, 2026 @02:37PM (#47507202)

You don't need open source access to be exploitable or exploited

[ Parent | on HN ]