While dealing with PHP Vulns and eMudhra certificates, you might want to have a look at #LiteLLM pop. The versions distributed since 11:00-17:00 CET on PyPI are loaded with an infostealer for Windows, MacOS, and Linux: https://research.jfrog.com/post/litellm-hijacked-again/. The last time I checked LiteLLM docker is still compromised.