Python Package Index (PyPI)

On March 24, 2026, malicious versions of the LiteLLM library (1.82.7 and 1.82.8) were hosted on the Python Package Index (PyPI) for approximately 40 minutes by threat actor Team PCP, exfiltrating 78,3…

A study of 12,180 popular Python package releases from PyPI found that only 15.4% of macaron rebuilds and 19.1% of oss-rebuild rebuilds are byte-for-byte identical to published wheels, but a new tool …