How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers

A broad set of high-impact incidents and active threats were reported, highlighting supply‑chain and social‑engineering compromises, large-scale credential theft, and multiple actively exploited vulnerabilities. Notable items include a supply‑chain attack leveraging developer workstations (LiteLLM/TeamPCP), a DPRK‑linked $285M exploit of Drift via a durable‑nonce social engineering campaign, ransomware groups Qilin and Warlock using BYOVD (vulnerable drivers) to disable 300+ EDR products, and 36 malicious npm packages posing as Strapi plugins to deploy implants and harvest secrets. Multiple 0‑