Malicious LiteLLM 1.82.7–1.82.8 via Trivy compromise deploys backdoor and steals credentials, enabling Kubernetes-wide persistence and lateral spread.

The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.

The compromised packages, linked to the Trivy breach, executed a three‑stage payload targeting AWS, GCP, Azure, Kubernetes configs, SSH keys, and automation pipelines before being removed.

Threat actors abused trusted Trivy distribution channels to inject credential‑stealing malware into CI/CD pipelines worldwide. This analysis walks through the Trivy supply‑chain compromise, attacker ...

The TeamPCP hacking group continues its supply-chain rampage, now compromising the massively popular "LiteLLM" Python package on PyPI and claiming to have stolen data from hundreds of thousands of ...

Supply chain attacks feel like they're becoming more and more common.

This article features deals sourced directly by Gizmodo and produced independently of the editorial team. We may earn a commission when you buy through links on the site. Reading time 2 minutes We all ...

The prices for active pharmaceuticals ingredients (API) will recover in FY27 due to the implementation of minimum import price (MIP) starting from 29 January 2026 and China’s withdrawal value-added ...

ExpressVPN launches industry's first Model Context Protocol (MCP) server The beta allows AI agents to interact directly with its VPN desktop apps The feature is opt-in, runs locally, and operates ...

Supported by favourable policies, rising domestic demand and shift towards complex active pharmaceutical ingredient (API), the Indian API market is projected to grow at a compounded annual growth rate ...

I wore the world's first HDR10 smart glasses TCL's new E Ink tablet beats the Remarkable and Kindle Anker's new charger is one of the most unique I've ever seen Best laptop cooling pads Best flip ...

ExpressVPN launched ExpressKeys and ExpressMailGuard, with ExpressAI soon. ExpressVPN is expanding beyond VPN into a broader security suite. Older ExpressVPN apps retire March 31, 2026, so update soon ...