The Package Registry Layer: How Supply-Chain Attacks Are Targeting Agent Infrastructure

The LiteLLM Breach and the New Reality of AI Infrastructure On March 24, 2026, the Python Package Index (PyPI) hosted malicious versions of the LiteLLM library—specifically 1.82.7 and 1.82.8—for ...
Help Net Security

DeepSeek’s popularity exploited to push malicious packages via PyPI

Two malicious packages leveraging the DeepSeek name have been published to the Python Package Index (PyPI) package repository, and in the 30 minutes or so they were up, they have been downloaded 36 ...
Computer Weekly

PyPI loophole puts thousands of packages at risk of compromise

Thousands of applications that have taken advantage of open source Python Package Index (PyPI) software packages may be at risk of hijacking and subversion by malicious actors, opening up the ...