TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 Likely via Trivy CI/CD Compromise

The Hacker News roundup highlights a wave of high-impact supply-chain and active-exploitation incidents. TeamPCP is tied to compromises of Trivy CI/CD and the litellm Python package (versions 1.82.7–1.82.8) that include credential harvesting, a Kubernetes lateral-movement toolkit, and a persistent backdoor; related follow-on activity has infected Docker images, hijacked npm packages (CanisterWorm) and abused GitHub Actions to steal CI/CD secrets. Separate large-scale campaigns include malvertising that delivers rogue ConnectWise ScreenConnect installers which drop HwAudKiller (BYOVD) to blindE