Top all-time · #10834
Rami McCarthy
Personal blog · ramimac.me · on HN as ramimacsecurityprogramming
Rami McCarthy writes High Signal Security, a personal blog at ramimac.me about security and programming. Since 2023, 7 different Hacker News readers have linked it 15 times, most often “Trivy Attacks”. It is still writing: the last post was on 2026-10-25, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN commenters link this blog's post on the trivy-related supply-chain compromise of the LiteLLM Python package. A LiteLLM maintainer cites it as a source of the incident timeline.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Cloud security research and engineering insights by Rami McCarthy.
Most-linked posts?
- Trivy Attacks3 people · 3 mentions · first linked 2026-03-24
- Industrial IAM Service Role Creation2 people · 2 mentions · first linked 2024-08-28
What Hacker News says?
LiteLLM maintainer here, this is still an evolving situation, but here's what we know so far: 1. Looks like this originated from the trivvy used in our ci/cd - https://github.com/search?q=repo%3ABerriAI%2Flitellm%20trivy... https://ramimac.me/trivy-teampcp/#phase-09 2. If you're on the proxy docker, you were not impacted. We pin our versions in the requirements.txt 3. The package is in quarantine on pypi - this bloc…
Comment linking /trivy-teampcp/
on “LiteLLM Python package compromised by supply-chain attack”Submitted An AWS IAM Security Tooling Reference as a story · 90 points
HN discussionThis is tied to the TeamPCP activity over the last few weeks. I've been responding, and keeping an up to date timeline. I hope it might help folks catch up and contextualize this incident: https://ramimac.me/trivy-teampcp/#phase-09
Comment linking /trivy-teampcp/
on “LiteLLM Python package compromised by supply-chain attack”Submitted How to Say "No" Well as a story · 2 points
HN discussionIt's a spam flood by the attacker to complicate information sharing[1]. They did the same thing in the Trivy discussion, with many of the same accounts.[2] [1] https://ramimac.me/teampcp/#spam-flood-litellm [2] https://ramimac.me/teampcp/#discussion-flooded
Comment linking /teampcp/
on “Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised”Submitted Poisoning the SSM Command Document Well as a story · 2 points
HN discussionWe haven't blogged this yet, but a variety of teams found this in parallel. The packages are quarantined by PyPi Follow the overall incident: https://ramimac.me/teampcp/#phase-10 Aikido/Charlie with a very quick blog: https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-... ReversingLabs, JFrog also made parallel reports
Comment linking /teampcp/
on “Telnyx v4.87.1 and v4.87.2 are compromised by TeamPCP”Submitted A multi-week, multi-ecosystem attack chain spanning GitHub Actions, npm, PyPI as a story · 1 points
HN discussionSubmitted Trivy Attacks as a story · 1 points
HN discussionSubmitted Industrial IAM Service Role Creation as a story · 1 points
HN discussionSubmitted Industrial IAM Service Role Creation as a story · 1 points
HN discussionSubmitted Publicly Exposed AWS SSM Command Documents as a story · 1 points
HN discussionSubmitted Publicly Exposed AWS Document DB Snapshots as a story · 1 points
HN discussionSubmitted A Guide to S3 Logging as a story · 1 points
HN discussion