Mercor confirms security incident tied to LiteLLM supply chain attack

LiteLLM confirmed a suspected supply-chain attack involving unauthorized PyPI package publishes that distributed malicious code; the compromise affected thousands of firms and prompted a clean release. Mercor — an AI recruiting and model-training company — confirmed it was impacted, is investigating with outside forensics, and faces claims from Lapsus$ that hundreds of gigabytes of its data were exfiltrated.