#pypi
Tagged “pypi”
2 articlesSecurity & supply chain
One credential, three tools deep: the LiteLLM supply-chain breach
CloudSEK, in reporting picked up by devops.com, puts the LiteLLM incident at about 2,500 companies and 434,000 CI/CD pipelines. The route ran through a vulnerability scanner before it reached LiteLLM, which is where the number gets uncomfortable.
Aug 13, 2026 · Tomás VegaSecurity & supply chainPyPI stops accepting late file uploads to releases older than 14 days
PyPI will no longer accept new files uploaded to a release once that release is more than 14 days old, closing a stealth path a compromised publishing token could otherwise use to graft malicious code onto an established package. PyPI has said it is not yet aware of the technique being used in a real attack.
Jul 28, 2026 · Maya Okonkwo