Building AI Security with Our Customers: 5 Lessons from Evo’s Design Partner Program

Snyk reports multiple software supply‑chain compromises: malicious versions of the Axios npm package (1.14.1 and 0.30.4) were published via a compromised maintainer account, adding a hidden dependency that deploys a cross‑platform remote access trojan (RAT). Separately, threat actor TeamPCP backdoored LiteLLM PyPI releases after stealing PyPI credentials by compromising a Trivy GitHub Action in LiteLLM’s CI/CD; the backdoor uses a three‑stage malware chain. Snyk provides affected versions, indicators, and guidance to detect and remediate exposure. No CVE identifiers are listed in the reports.