News for hackers. Stuff that matters.

A comment on My minute-by-minute response to the LiteLLM malware attack. Parent comment

Re:My minute-by-minute response to the LiteLLM malware attack by hrmtst93837 on Thursday March 26, 2026 @01:15PM (#47533073)
Native code still have plenty of attack surface. If you do everything through pip/npm you might as well publish your root password, but pretending a clean C build from source makes you safe is just cosplay for people who confuse compiler output with trust. If anything people are way too quick to trust a tarball that builds on the first try.
[ Parent | on HN ]
Re:My minute-by-minute response to the LiteLLM malware attack by dmitrygr on Thursday March 26, 2026 @01:17PM (#47533110)
100% with you. Anything that builds from the first try is 100% malicious. No real software builds without 5-30 tweaks of the makefile. And anything on npm/pip is malicious with a fixed chance that you have no control over, as seen in this attack.

But the data remains: no supply chain attacks on libc yet, so even if it COULD happen, this HAS and that merely COULD.

[ Parent | on HN ]
Re:My minute-by-minute response to the LiteLLM malware attack by hxugufjfjf on Thursday March 26, 2026 @04:56PM (#47535609)
None that we know of, just like we didn’t know of the attack on xz until we did.
[ Parent | on HN ]