News for hackers. Stuff that matters.

A comment on Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library. Parent comment

Re:Shai-Hulud Themed Malware Found in the PyTorch Lightning ... by moritzwarhier on Thursday April 30, 2026 @04:42PM (#47967954)
What filter?

You say you rely on CC to suggest software to install from the internet, and then you install it.

I haven't heard anyone suggest CC or any LLM as a "filter" for "is this package safe right now", and it seems like a very bad heuristic to me, not only, but also for the reason you gave.

[ Parent | on HN ]
Re:Shai-Hulud Themed Malware Found in the PyTorch Lightning ... by nrengan on Thursday April 30, 2026 @05:04PM (#47968206)
Well, people weren't checking CVEs before pip install before CC either, CC just scaled the habit to a larger audience at a faster cadence. The blast radius for day-zero compromises is what changed.
[ Parent | on HN ]
Re:Shai-Hulud Themed Malware Found in the PyTorch Lightning ... by ShyCodeGardener on Friday May 01, 2026 @09:01AM (#47974289)
How has the blast radius changed though? The vibecoders that weren't developers before? If someone switched from pip installing themselves to having Claude do it, I don't see how that increased the blast radius.
[ Parent | on HN ]