News Summary

• The latest victim of the group is BerryAI’s popular LiteLLM library, a unified interface that makes it easier for apps to switch between various LLMs.
• TeamPCP is also believed to have compromised a number of NPM packages, which were equipped with a Python backdoor.
• And, according to Aikido researchers, they also deployed a Kubernetes node or local machine wiper when the target is (geo)located in Iran.
• Sonatype advises organizations that installed or executed them to identify and remove the malicious package from affected systems.