Yesterday, LiteLLM 1.107.0 was live on PyPI for two hours with a credential stealer embedded in every wheel. Anyone who ran pip install litellm during that window handed over AWS keys, GitHub tokens, and Anthropic API credentials to an attacker who had compromised a developer release pipeline. That attack targeted developers making a manual install. The scarier problem targets your AI coding agent, which installs packages, configures MCP servers, and pulls dependencies all day, autonomously, without anyone reviewing a single pull. Sonatype new Nexus Repository Pro+ is built specifically for this problem. The Problem Nobody Has Solved Yet Traditional supply […]
The post
source & further reading
byteiota.com — original article
Hugging Face Transformers 5.0: What Breaks and What’s New
Notion Rebuilds Its AI Agent: 24-Hour Tasks, 90% Cost Cut
KiviDB Open Source: Rust Redis with Built-in Vector Search