PyPI advisories

Python package and PyPI supply-chain advisories: hijacked releases, malicious packages and poisoned dependencies.

CriticalSupply chainPatch available

LiteLLM 1.107.0: poisoned PyPI and Docker release built from a lookalike repository

Attackers with stolen gh CLI tokens shipped malware as LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR. Check before running Python, then rebuild and rotate.

21 Oct 2026PyPI AI developer tools CI/CD

CriticalSupply chainMonitoring

TeamPCP campaign (CVE-2026-33634): Trivy, KICS, LiteLLM and Telnyx turned into credential stealers

Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.

19 Mar 2026CVE-2026-33634GitHub Actions PyPI CI/CD AI developer tools