News for hackers. Stuff that matters.

A comment on LiteLLM Python package compromised by supply-chain attack. Parent comment

Re:LiteLLM Python package compromised by supply-chain attack by miraculixx on Tuesday March 24, 2026 @02:16PM (#47506879)
I agree in general, but how are you ever upgrading any of that? Could be a "sleeper compromise" that only activates sometime in the future. Open problem.
[ Parent | on HN ]
Re:LiteLLM Python package compromised by supply-chain attack by jFriedensreich on Tuesday March 24, 2026 @02:18PM (#47506911)
A sleeper compromise that cannot execute can still not reach its goal. Generally speaking outdated dependencies without known compromise in a sandbox are still better than the latest deps with or without sandbox.
[ Parent | on HN ]