Top all-time · #6348
JFrog Security Research
Company blog · research.jfrog.com/postsecurity
JFrog Security Research is the company blog at research.jfrog.com, writing about security. Since 2023, 12 different Hacker News readers have linked it 12 times, most often “LiteLLM Hijacked: Malicious 1.107.0 Wheels Steal Credentials”. It is still writing: the last post was on 2026-11-01, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link JFrog Security Research for analysis of malicious packages and supply-chain attacks, such as a compromised LiteLLM 1.107.0 on PyPI, a malicious Rust crate, and a password-cracked loader.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
The latest security issues and vulnerabilities discovered by the JFrog security research team! CVE's, malicious packages and more
Most-linked posts?
- LiteLLM Hijacked: Malicious 1.107.0 Wheels Steal Credentials2 people · 2 mentions · first linked 2026-10-21
What Hacker News says?
1792590200 | LiteLLM Hijacked: Malicious 1.107.0 Wheels Steal Credentials | https://research.jfrog.com/post/litellm-hijacked-again/ | https://news.ycombinator.com/item?id=50180838 | 0 comments 1792590232 | Litellm 1.107.0 Compromised | https://github.com/BerriAI/litellm/issues/47826 | https://news.ycombinator.com/item?id=50180845 | 0 comments
Comment linking /post/litellm-hijacked-again/
on “Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor”Submitted Critical CVE issued for hallucinated SQLite vulnerability as a story · 57 points
HN discussionYou need to read quite a ways before discovering that JFrog did the work of cracking the password, which enabled the rest of the analysis. https://research.jfrog.com/post/equation-of-compromise/
Comment linking /post/equation-of-compromise/
on “Why does mathmain need an encrypted loader?”Submitted LiteLLM Hijacked: Malicious 1.107.0 Wheels Steal Credentials as a story · 4 points
HN discussionThread on the post from main rust blog: https://news.ycombinator.com/item?id=49372853 Direct post link: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... Initial report: https://github.com/rustsec/advisory-db/issues/3161 Other vendor posts: * https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-... * https://research.jfrog.com/post/arrayref-proc-macro1-crates-... * https://www.aikido.dev/blog/tw…
Comment linking /post/arrayref-proc-macro1-crates-io/
on “Malicious Rust Crate Arrayref Runs a Build-Time Payload”Submitted Native addon camouflage: 42 armed GitHub repos reveal hidden NPM publisher as a story · 2 points
HN discussionSubmitted Shai Hulud campaign strikes NPM again as a story · 2 points
HN discussionSubmitted TeamPCP Campaign Spreads to NPM via a Hijacked Bitwarden CLI as a story · 2 points
HN discussionSubmitted TeamPCP strikes again: Xinference (v2.6.0-2.6.2) PyPI package compromised as a story · 1 points
HN discussionSubmitted TeamPCP strikes again – telnyx popular PyPI library compromised as a story · 1 points
HN discussionSubmitted Potentially Critical RCE Vulnerability in OpenSSL as a story · 1 points
HN discussionSubmitted Security Research to Protect the Modern Software Supply Chain as a story · 1 points
HN discussion
