News for hackers. Stuff that matters.

A comment on LiteLLM Python package compromised by supply-chain attack. Parent comment

Re:LiteLLM Python package compromised by supply-chain attack by kleton on Tuesday March 24, 2026 @11:12AM (#47503851)
There are hundreds of PRs fixing valid issues to your github repo seemingly in limbo for weeks. What is the maintainer state over there?
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by michh on Tuesday March 24, 2026 @11:28AM (#47504097)
increasing the (social) pressure on maintainers to get PRs merged seems like the last thing you should be doing in light of preventing malicious code ending up in dependencies like this

i'd much rather see a million open PRs than a single malicious PR sneak through due to lack of thorough review.

[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by zparky on Tuesday March 24, 2026 @11:17AM (#47503936)
Not really the time for that. There's also PRs being merged every hour of the day.
[ Parent | on HN ]