ramimac
Joined 10 years ago
Karma
1,838
Submissions
198
Member since
Apr 13
Recent submissions
Comment · 2 months ago
Thread on the post from main rust blog: https://news.ycombinator.com/item?id=49372853
Direct post link: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on...
Initial report: https://github.com/rustsec/advisory-db/issues/3161
Other vendor posts:
* https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-...
* https://research.jfrog.com/post/arrayref-proc-macro1-crates-...
* https://www.aikido.dev/blog/two-popular-rust-crates-arrayref...
Comment · 6 months ago
Carlini's unprompted talk is one source: https://www.youtube.com/watch?t=204&v=1sd26pWhfmg
Comment · 7 months ago
We haven't blogged this yet, but a variety of teams found this in parallel.
The packages are quarantined by PyPi
Follow the overall incident: https://ramimac.me/teampcp/#phase-10
Aikido/Charlie with a very quick blog: https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-...
ReversingLabs, JFrog also made parallel reports
Comment · 7 months ago
It's a spam flood by the attacker to complicate information sharing[1]. They did the same thing in the Trivy discussion, with many of the same accounts.[2]
[1] https://ramimac.me/teampcp/#spam-flood-litellm [2] https://ramimac.me/teampcp/#discussion-flooded
Comment · 7 months ago
Blood, sweat, and tears.
The investment compounds! I have enough context to quickly vet incoming information, then it's trivial to update a static site with a new blurb
Comment · 7 months ago
This is tied to the TeamPCP activity over the last few weeks. I've been responding, and keeping an up to date timeline. I hope it might help folks catch up and contextualize this incident:
Comment · 7 months ago
> Upon issue creation another workflow spins up three independent coding agents to analyze the finding.
I'm curious
1) what the current statistics are for consensus
2) how the agents may/may not perform independently
3) what the agent profiles are and how they differ (model, harness, prompt/persona, all three?)
https://ramimac.me