Canonical event

LiteLLM reports malicious PyPI package versions distributed on March 24

LiteLLM documented a supply-chain compromise involving PyPI releases 1.82.7 and 1.82.8 published on 24 March 2026. The precise affected installations, downstream exfiltration and alleged Mercor causal chain require separate proof.