3 ms·
Has anyone tested general purpose malware detection on supply chains ? Like clamscan . I tried to test the LiteLLM hack but the affected packages had been pulle
by tonymet 7mo ago
Has anyone tested general purpose malware detection on supply chains ? Like clamscan . I tried to test the LiteLLM hack but the affected packages had been pulled. Windows Defender AV has an inference based detector that may work when signatures have not yet been published
- esseph 7mo ago> Has anyone tested general purpose malware detection on supply chains ? Like clamscan You could use Trivy! /s
- jesse_dot_id 7mo agoI second this question. I usually scan our containers with snyk and guarddog, and have wondered about guarddog in particular because it adds so much build time.
- Imustaskforhelp 7mo ago> tried to test the LiteLLM hack but the affected packages had been pulled Hey, I have been part of the archival effect/Litellm issue thread. I think I have stored them in archive.org for preservation purposes https://web.archive.org/web/20260325073027/https://files.pythonhosted.org/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz https://web.archive.org/web/20260325073027/https://files.pyt... (I have also made an archive of the github issue with all the comments manually till a certain point at https://web.archive.org/web/20260325054202/https://serjaimelannister.github.io/litellm-comments/ https://web.archive.org/web/20260325054202/https://serjaimel...)
- tonymet 7mo agothanks for highlighting that i will take a look and see if there's similar archive for the other vulnerabilities as well . If i can make it work with clamscan & MS Defender i'll run a scan and try to report back
- Imustaskforhelp 7mo agoGlad to see that Clamscan experiment worked. Keep me updated on the continued testing and I am glad that my archival efforts are appreciated :)
- tonymet 7mo agoabsolutely massive help. i love HN community and thanks. If you do see an archive of axios or other compromised artifacts, please send those my way for continued testing. i'm going to test automation and see if this actually has utility.
- Imustaskforhelp 7mo agoHey tony, sorry I had read your comment, I was a little busy. I will try to do something about axios tomorrow to help you out! And I love HN community too and your welcome!
- tonymet 7mo agono worries. I ended up finding a compromised axios archive online and the test worked, with the unofficial sigs https://github.com/extremeshok/clamav-unofficial-sigs/tree/master https://github.com/extremeshok/clamav-unofficial-sigs/tree/m...
- tonymet 7mo agothe primitive clamscan experiment worked! it detected Txt.Trojan.TeamPCP-10059839-1 from the .tar.gz archive. I'll continue testing to see if it's viable # apk add clamav-scanner freshclam # freshclam # curl -LO https://web.archive.org/web/20260325073027/https://files.pythonhosted.org/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz # clamscan litellm-1.82.8.tar.gz Loading: 6s, ETA: 0s [========================>] 3.63M/3.63M sigs Compiling: 2s, ETA: 0s [========================>] 41/41 tasks /root/supply-chain-scanner/pkg/litellm-1.82.8.tar.gz: Txt.Trojan.TeamPCP-10059839-1 FOUND ----------- SCAN SUMMARY ----------- Known viruses: 3627757 Engine version: 1.4.4 Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 94.98 MB Data read: 16.59 MB (ratio 5.72:1) Time: 50.057 sec (0 m 50 s) Start Date: 2026:04:01 19:57:23 End Date: 2026:04:01 19:58:13