TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise

This collection highlights multiple high-impact supply-chain and large-scale malware incidents across developer and enterprise ecosystems. Key issues include TeamPCP compromising Trivy/KICS and publishing backdoored Python package litellm (v1.82.7–1.82.8) with credential harvesting, Kubernetes lateral-movement tooling and persistent backdoors; Trivy GitHub Actions compromise and Docker/ npm follow-on infections (including a self-propagating CanisterWorm); Checkmarx GitHub Actions breaches; and widespread malicious npm and PyPI/package abuse. Other notable threats: a malvertising campaign using