LLM policy?(github.com)

151 points by dropbox_miner 11 months ago | 95 comments

Codex logging bug may write TBs to local SSDs(github.com)

454 points by vantareed 4 months ago | 249 comments

GitHub issue on openai/codex reporting that Codex CLI's SQLite feedback logs can write about 640 TB per year, rapidly wearing out SSDs.

Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer(github.com)

701 points by theanonymousone 7 months ago | 281 comments

GitHub issue in BerriAI/litellm reporting a malicious litellm_init.pth file in the 1.82.8 PyPI package that steals credentials via a supply chain compromise.

Post Mortem: axios NPM supply chain compromise(github.com)

267 points by Kyro38 6 months ago | 119 comments

Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior(github.com)

80 points by patadune 1 year ago | 9 comments

Nitter and XCancel receive cease and desist notices(github.com)

1087 points by Banditoz 2 months ago | 914 comments

GitHub issue on the Nitter repository reporting that all public Nitter instances have stopped working, shown with a Twiiit redirect proxy screenshot.

I'm being cyberattacked by Tesla, Inc(dreamstation.systems)

389 points by robinpie 1 month ago | 109 comments

Personal blog post describing persistent attack traffic in nginx logs from IPs with Host/Referer headers pointing to pool-ntp.tesla.com.

GitHub has not removed malicious imitation software after 3 weeks(successfulsoftware.net)

215 points by hermitcrab 1 month ago | 89 comments

A Successful Software blog post complaining that GitHub has not removed malicious software imitating the author's product three weeks after it was reported.

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware(github.com)

367 points by tosh 1 year ago | 263 comments

GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.

Upcoming breaking changes for npm v12(github.blog)

459 points by plasma 4 months ago | 189 comments

GitHub Changelog post announcing upcoming breaking changes in npm version 12.

NPM flooded with malicious packages downloaded more than 86k times(arstechnica.com)

349 points by jnord 1 year ago | 248 comments

Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.

Compromising OpenWrt Supply Chain(flatt.tech)

546 points by udev4096 1 year ago | 91 comments

Flatt Security research post by RyotaK describing a supply chain attack against OpenWrt's firmware build service involving a SHA256 hash collision.