PyPI supply chain attack hits data/ML pipelines: elementary-data compromised via

<!-- SC_OFF --><div class="md"><p>LiteLLM is widely used in LLM/agent pipelines, which makes this supply chain attack particularly concerning.</p> <p>Malicious releases (via

<!-- SC_OFF --><div class="md"><p>New paper from UC Santa Barbara </p> <p>They formalized four attack classes against LLM API routers (the intermediaries that dispatch

<!-- SC_OFF --><div class="md"><p>If you’re doing AI/LLM development in Python, you’ve almost certainly used <code>litellm</code>—it’s the package that unifies calls to OpenAI,

<table> <tr><td> <a href="https://www.reddit.com/r/ChatGPT/comments/1s4u84u/the_trivy_cascade_75_poisoned_tags_a_blockchain/"> <img alt="The Trivy Cascade: 75 Poisoned Tags, a

<p>Three incidents landed in five days this week. Different attack surfaces, different techniques, different threat actors. What they have in common is that none of them required

<p>In May 2026, a worm called Shai-Hulud compromised 42 TanStack packages — including <code>@tanstack/react-router</code>, a library sitting in millions of JavaScript projects. It

<p>Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware.</p> <p>This was not a phishing campaign.

<!-- SC_OFF --><div class="md"><p>A malware was found inside a popular Codex-related tool that steals developer credentials like usernames, passwords, and access tokens. It may