News for hackers. Stuff that matters.

andymcsherry

Andy from Lightning here. Yeah, the PyPi credentials were stolen through the compromised pl-ghost bot account. The attacker used this account to create a new actions workflow, which was ran and parsed out secrets for PyPi. After releasing the package, the attacker then used that account to troll us a bit with those comments.
Andy from Lightning here. The malicious file that gets installed has this signature:

  router_runtime.js

  SHA256 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1
  SHA1 f1b3e7b3eec3294c4d6b5f87854a52471f03997f
  MD5 40d0f21b64ec8fb3a7a1959897252e09
Andy from Lightning here. The malicious packages were published today at 12:45 PM UTC to PyPi. Before that, there were no affected distributions, and we were unaware of any leak. The original release on Github did not contain the issue, but we have taken it down to prevent any confusion.
Andy from Lightning here. The malicious code was not submitted to the main repo at Github. It appears our PyPi credentials were leaked and compromised packages were published directly there for versions 2.6.2 and 2.6.3
Andy from Lightning here. Thanks for pointing that out, we are updating the CVE. Only the versions from PyPi were affected. The malicious code was not checked into the GitHub repository
Re:Chatterbox TTS on Thursday June 12, 2025 @10:42AM (#44258402)
Hey ipsum, sorry I could have mentioned that. We spend a ton of effort on open source and sharing our ML knowledge with the community. If you don't want to use our platform, the entire source code and a tutorial is there to run it on your own.
Re:Chatterbox TTS on Wednesday June 11, 2025 @11:20PM (#44254015)
Re:The Secret Formula for Faster Trains on Tuesday April 15, 2025 @01:52AM (#43689383)
Australia has a slowish rail network because it is sparsely populated. It is an extreme version of America, the distances between population centers are quite large and there's not much in-between. There's also not much reason for anyone from Sydney to visit Canberra, and if you do, you certainly need a car to get around.
That’s the software platform used to deploy it
Re:LitServe: Easily serve AI models fast on Thursday August 22, 2024 @12:26PM (#41321921)
LitServe is a flexible serving engine for AI models built on FastAPI. Features like batching, streaming, and GPU autoscaling eliminate the need to rebuild a FastAPI server per model.

The examples featured on the litserve page include a range of applications such as large language models (LLMs), natural language processing (NLP), multimodal tasks, audio processing, vision models, speech synthesis, classical machine learning (ML) algorithms, and a media conversion API, demonstrating the versatility of litserve in deploying various machine learning models and services.

Re:The open weight Flux text to image model is next level on Friday August 02, 2024 @03:55AM (#41136940)
I get the sentiment, but one of their models, albeit the worst one, is licensed under Apache without usage restrictions. The source to run the models is also open source.
Yeah, disagree. College sports generate a significant amount of revenue for the university, which funds scholarships for a huge number of students that otherwise couldn't afford to go there. They have the added benefit of being fun and add entertainment to the college experience.
> You may deposit or withdraw funds from your Account into or from Apple Cash. Transfers must be at least $1.00 and can be no more than $10,000. You may transfer no more than $20,000 per rolling 7-day period. We may place additional limits on the amount and frequency of transfers for the security of your Account

Seems to be just transfers to an Apple Cash account, which is primarily used for free Venmo-like peer to peer payments. Venmo has a similar $20k limit. I think if you're trying to transfer this much money, there are plenty of other transfer methods available.

https://www.goldmansachs.com/terms-and-conditions/Deposits-A...

Re:How Big Is Mexico? on Thursday April 13, 2023 @04:31AM (#35552578)
These comparisons come up all the time, and the issue is the Mercator projection makes Europe looks much larger than other countries on most maps. Much of Europe lies at a more extreme latitude than to the rest of the world. Basically nothing is at the same latitude in the Southern hemisphere and the only comparisons in the Northern hemisphere are Russia, Canada and Greenland. Other than Greenland, those countries don't generally get compared because they are gigantic in their own right, despite being much smaller than the appear on normal map projections.
Re:Cyclists Now Outnumber Motorists in City of London on Monday March 20, 2023 @10:21AM (#35231886)
Car insurance liability limits will be insufficient if you kill someone, and you’ll be on the hook for the remainder. Umbrella will cover you in both scenarios.
People don’t make a bunch pies in fall and then store them for winter. They’ll store rawer ingredients, like flour, live animals or dried and pickled veggies and meats that don’t perish as easily.
If you read the article, you can tell they are talking about people who have applied, but not yet received their green card. Citizens of some countries have a decade or longer wait to get processed.
Re:DRY is an over-rated programming principle? on Thursday July 07, 2022 @03:25AM (#32010889)
Two instances isn't worth consolidating because it's hard to know whether the similarities are real or coincidental. Check out the rule of three: https://en.wikipedia.org/wiki/Rule_of_three_(computer_progra...
This is a business, it's not passive income. It requires maintenance, support, etc. If he were to just let it ride, income might increase for a while but ultimately wither out and die.
If you use the USPS API, it gives you a specific message if it's a multi-unit address:

Default address: The address you entered was found but more information is needed (such as an apartment, suite, or box number) to match to a specific address.

Verify API, page 11

https://www.usps.com/business/web-tools-apis/general-api-dev...

Re:Show HN: Three Magic Words on Tuesday February 08, 2022 @09:26PM (#30267929)
Had a similar issue, tried to use VIXEN and DIMES, but VINES and MIXED was the "correct" answer.
Re:California's housing bill SB 50 has died in the state Senate on Thursday January 30, 2020 @07:18PM (#22197558)
Yea: 18, Nay: 15: Not Voting: 6

The measure fails despite more Yea than Nay votes. The California State Senate has 40 seats and always require 21 votes to pass. Vacancies (currently 1), absences and abstentions don't appear to affect the denominator of the 51% threshold. As a result, Not Voting is essentially a disguised no vote.

Re:Dad takes son to Mongolia to get him off his phone on Thursday January 02, 2020 @03:30PM (#21939459)
Wyoming and Montana are definitely not in the Midwest, and I’d even argue that the Western South Dakota where the Badlands are should be considered the Mountain West as well. The majority of the Midwest is far more populated than this region
Re:The falling price of a TV set on Tuesday December 17, 2019 @04:59AM (#21812169)
Insurance companies can run a sort of mini credit score with just a name and address. It doesn’t show up as a credit inquiry and has a more limited set of details about each item.
Re:Why American Construction Costs Are So High on Tuesday March 05, 2019 @05:25PM (#19314841)
You can buy futures on basically any commodity to hedge against price fluctuations.
Re:Self-Driving Cars Might Kill Auto Insurance as We Know It on Tuesday February 19, 2019 @08:02PM (#19204663)
There are other things your insurance covers, like an uninsured driver hitting your car, theft, a tree falling on your car, etc. These things will still happen to self driving cars.
Re:Chinese New Year Is World’s Biggest Human Migration on Monday February 04, 2019 @02:25AM (#19074562)
I’m sure these things can be tracked by analyzing the currency exchange patterns between HK and the mainland

Older »