Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.
Folks, if any of you used LiteLLM, now is the time to change your credentials, at an atomic level. Now, as in immediately.
https://news.ycombinator.com/item?id=47501729
Dan Goodin
npub1z3…8qvzu
2026-03-24 17:49:22 CET
Author Public Key
npub1z3lwfekw80j4ngzg6ky3ks202xr6uwnd4jttxzsd4euc9l55euvq48qvzuPublished at
2026-03-24 17:49:22 CETEvent JSON
{
"id": "2cbe66b71897d7f45d762f8f90fe118e267c354f675b02d470780e794ee84bec",
"pubkey": "147ee4e6ce3be559a048d5891b414f5187ae3a6dac96b30a0dae7982fe94cf18",
"created_at": 1774370962,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@dangoodin/116285175398594132",
"web"
],
[
"proxy",
"https://infosec.exchange/users/dangoodin/statuses/116285175398594132",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/dangoodin/statuses/116285175398594132",
"pink.momostr"
],
[
"-"
]
],
"content": "Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.\n\nFolks, if any of you used LiteLLM, now is the time to change your credentials, at an atomic level. Now, as in immediately.\n\nhttps://news.ycombinator.com/item?id=47501729",
"sig": "e4c0a937461242fd3f2380d2042d90dbfb61d42803ca73f4f220c49591b64e70b2c7a1ac8974e7c7c568bddcab76aca51e5372bf82a00188f6148c0f7fcb5b8c"
}