TLDR Tech / IT
TeamPCP software supply chain attack spreads to LiteLLM (3 minute read)
The TeamPCP supply chain attack has expanded from security tools like Checkmarx and Trivy to the AI ecosystem, compromising the popular Python library LiteLLM. Attackers used stolen credentials to poison PyPI versions 1.82.7 and 1.82.8 with an infostealer designed to harvest cloud secrets, SSH keys, and Kubernetes tokens. Developers are urged to pin their dependencies to version 1.82.6 or earlier and rotate all environment credentials immediately.
Read the full story