project
Python LLM gateway/proxy package whose two poisoned versions were published to PyPI on March 24 and stayed live roughly 40 minutes.
No evidence-backed relationships are recorded.
GitGuardian says the TeamPCP campaign poisoned two LiteLLM releases on PyPI to harvest SSH keys, cloud credentials and API tokens. Detection is the cheap part of this job.
Reality
Hudson Rock's analysis of the exfiltration archive ties 118,829 CI runner dumps to 2,488 organizations. The dumps carrying no identifying metadata are the harder half.
Reality
The vendor reports 10-plus CVEs and up to 200,000 exposed instances, and says Anthropic declined to change the protocol, describing the behaviour as expected.
Reality
A 9B MIT-licensed coding model that reportedly matches a 31B rival on SWE-Bench Verified is still unusable as a Claude Code backend, because the runtime never turns its tool-call XML into a file write.
Reality
Check Point Research says a nonce bug in every public VECT build leaves files above 131,072 bytes unrecoverable, by the attacker as well. That turns extortion into destruction.
Reality
VMR's maintainer publishes routing overhead and cache-hit numbers to argue that unattended coding agents need byte-faithful pass-through and session affinity. Everything else is complexity.
Reality
A 2.5-year retrospective spanning more than 250 engineering teams credits a LiteLLM-based API proxy, stood up in January 2024, for metering adoption and forcing client upgrades.
Reality
A backdoored LiteLLM build was downloaded about 47,000 times in a three-hour window. Most agent incidents never get a CVE, so your scanner dashboard is not the control you think it is.
Reality
SOCRadar's record-level data puts 95 percent of identified victims before the poisoned LiteLLM packages ever hit PyPI. Anyone who rotated only what LiteLLM touched is still exposed.
Reality