AI recruitment firm Mercor confirms a supply chain attack on its widely-used open-source project LiteLLM, linked to hacker groups TeamPCP and Lapsus$. The incident, impacting thousands of enterprises, exposed internal data and triggered a security review of open-source dependencies. Mercor has initiated remediation and switched compliance providers.