On March 24, 2026, a supply chain attack against LiteLLM — one of the most widely deployed LLM proxy and observability libraries — compromised the PyPI packages used by engineers to instrument their AI agents. The attacker had already worked through two upstream targets: Aqua Security's Trivy scanner (March 19), then Checkmarx's KICS and AST...