AI recruiting biz Mercor says it was 'one of thousands' hit in LiteLLM supply-chain attack

TeamPCP compromised popular open-source developer tools (including Trivy, KICS, and packages on PyPI such as LiteLLM), injecting credential-stealing malware that has been used to validate stolen secrets, move laterally, and exfiltrate large amounts of data; downstream victims include AI hiring startup Mercor which reportedly had source code stolen. The campaign is widespread and ongoing, with estimates of thousands to hundreds of thousands of impacted systems and active collaboration between TeamPCP and extortion/ransomware groups to monetize stolen data.