6 min read
Incident Reports On October 21, 2026, malicious LiteLLM 1.107.0 wheels and Docker images carried a startup-hook credential stealer and a remote code loader. Timeline, IOCs and response steps.
pypi
7 min read
Threat Actors TeamPCP, tracked as UNC6780 by Google's Threat Intelligence Group, ran three coordinated supply chain campaigns in 2026 — poisoning Trivy, LiteLLM, and 170+ npm/PyPI packages — culminating in the theft of 3,800 GitHub internal repositories.
6 min read
Research LLMs suggest non-existent package names in 20-30% of coding responses. Attackers register these hallucinated names with malicious payloads — slopsquatting as a supply chain attack.