Another npm supply chain worm is tearing through dev environments

Multiple active and emerging threats reported: a new npm supply‑chain 'worm' is propagating through developer environments to steal secrets and sensitive data (payload references 'TeamPCP/LiteLLM'), while several other incidents show active exploitation and data theft. Notable items include a Vercel breach tied to OAuth abuse and a compromised employee account (Context.ai implicated), Cisco Catalyst SD‑WAN Manager vulnerabilities under active attack with an urgent CISA advisory, a newly‑exploited long‑standing Apache ActiveMQ bug placed on KEV, a macOS ClickFix AppleScript infostealer exfiltr‑