SentinelOne AI stopped a LiteLLM supply chain attack in seconds, blocking malicious code automatically without human intervention.
SentinelOne’s AI-based security detected and blocked a supply chain attack involving a compromised LiteLLM package.
SentinelOne’s macOS agent detected and stopped a malicious process chain triggered by Claude Code after it unknowingly installed a compromised LiteLLM package. The AI identified suspicious hidden Python code execution via base64 decoding, and killed the process within seconds across hundreds of events. The system traced the full process chain triggered by an AI agent and prevented data theft or further spread, showing the power of autonomous, behavior-based defense.
Attackers indirectly compromised LiteLLM by first breaching trusted tools like Trivy, stealing maintainer credentials to publish malicious versions. The campaign also hit other platforms, showing how open-source trust can be abused. In one case, an AI coding assistant unknowingly installed the infected package, highlighting a new risk: AI agents with full system access can spread attacks automatically.
“SentinelOne’s behavioral detection operates below the application layer. It does not matter whether a malicious package is installed by a human, a CI pipeline, or an AI agent.” reads the report published by SentinelOne. “The platform monitors process behavior via the Endpoint Security Framework, which is why this detection fired regardless of how the infected package arrived.”
Two malicious versions ensured execution, one during normal use, the other at Python startup, expanding the attack’s reach even to systems not actively using LiteLLM.
The LiteLLM attack began with a small, obfuscated script that launched silently, followed by a data stealer that collected system info, credentials, crypto wallets, and secrets. The malware then ensured persistence by installing a disguised system service that ran in the background and contacted its command server at long intervals to avoid detection.
“The third stage established persistence through a systemd user service at ~/.config/systemd/user/sysmon.service, executing a script at ~/.config/sysmon/sysmon.py.” continues the report. “The persistence mechanism included a 5-minute initial delay before any network activity, a technique specifically designed to outlast automated sandbox analysis. After that, the script contacted its C2 server every 50 minutes, fetching dynamic payload URLs.”
The attack expanded beyond the initial machine by creating privileged Kubernetes pods, gaining deep access to cluster nodes and deploying backdoors. Stolen data was encrypted and sent to a server designed to look legitimate, helping it bypass monitoring. Overall, the attack shows how modern threats combine stealth, automation, and multiple layers to move quickly and evade traditional defenses.
“The LiteLLM detection wasn’t a one-off. It’s what happens when autonomous, behavioral AI is built into the foundation, not bolted on after the fact.” concludes the report.
Modularity was one of the most exciting phone trends of the 2010s. It promised phones that would work like desktop PCs, allowing owners to upgrade individual components, add new functionalities, and replace broken parts with ease, improving longevity and ushering in a new, sustainable smartphone era.
While its early days looked promising thanks to pioneers like Modu, which launched the first modular phone in 2008, Google’s Project Ara, and Motorola’s Moto Z lineup, the modularity dream ultimately fizzled out. But not before begetting a few exciting modular phones that captured our attention, if nothing else.
1
Google Project Ara
Credit: Google
After Google acquired modular phone-related patents from Modu, which closed its doors in 2011, Google and Motorola, which Google bought in 2011, began exploring the modular phone concept in 2012. Google Project Ara officially kicked off in 2013, with the design philosophy based on Dave Hakkens’ Phonebloks concept.
The original idea was for Google/Motorola to produce the phone’s base, the so-called “Endo” (exoskeleton) frame, with third-party vendors providing everything else, from displays to cameras to batteries. Modules would attach to the phone via an innovative magnetic mechanism with hot swap support.
Credit: Google
The dream was to provide a modular phone where almost everything would be easily replaceable and upgradable. Google had to walk back some of the original design choices, such as the ability to replace the screen and the SoC, due to hardware limitations, but the project didn’t abandon its promise of modularity.
Sadly, after three years of development, Google pulled the plug on Project Ara in September 2016, citing high costs and manufacturing issues. Project Ara (kind of) lived on in Motorola’s Moto Mods, but we’ve never gotten a proper Project Ara modular smartphone.
A crying shame because the college me had his mind blown by the whole modular phone movement of the 2010s. Even today, I’d love nothing more than to play around with Project Ara prototypes, if only for a few minutes.
2
LG G5
Credit: LG Mobile
LG had a few Android hits back in the early 2010s. The LG G2 is still one of the prettiest Android phones ever, and it sold quite well. The G3 ironed out its predecessor’s kinks while keeping up its sales momentum. But the upward trajectory stalled with the LG G4, so the Korean giant decided to shake up its flagship series.
Enter the LG G5, one of LG’s most ambitious phones ever. The phone’s bottom segment was removable, allowing owners to quickly install modules LG touted as “Friends,” which included various extra functionalities. You had a high-end DAC and Amp, a module that packed extra battery capacity and additional camera controls, and a module with a replaceable battery, allowing you to swap in a new one in a jiff.
Credit: LG
While the phone piqued the attention of smartphone enthusiasts, myself included, sales showed that the mainstream audience wasn’t exactly engrossed by the concept. Ultimately, the LG G5 had disappointing sales numbers, and LG abandoned its “friends” modular add-ons ecosystem shortly after, with the G5 staying the only modular phone in LG’s lineup.
Credit: Lucas Gouveia/How-To Geek | Essential Products
The Essential Phone had a lot going for it even before it hit the shelves. The brainchild of Andy Rubin, the father of Android, the phone created quite a buzz in the tech world back when it was announced in the spring of 2017. Its bold design, which debuted the notch, ditched the 3.5mm headphone jack, and made the two camera lenses flush with the phone’s slick ceramic back, was a head turner.
Early promotional photos showed the phone with a camera module attached. It was later revealed that the Essential PH-1 features a magnetic Click Connector on the upper right of its back. The connector allowed the PH-1 to be used with custom-made modules, and while Essential only provided one module at launch, the 360° camera, it promised more modules further down the road.
Credit: Essential
Alas, the Essential PH-1 didn’t sell that well, even after receiving a $200 price reduction shortly after launch. This affected Essential’s promise of modularity. Ultimately, we only got one extra module that incorporated a headphone jack and a high-end DAC. While the PH-1 had a lot of promise (I loved its vanilla Android experience, modularity, and flush design), it didn’t pan out. Its successor, the Essential PH-2, was canceled, we never got new modules, and Karl Pei’s Nothing bought the Essential brand in 2021.
4
Motorola Moto Z
Credit: Motorola
Motorola’s Moto Mods modular ecosystem is, hands down, the most well-received, popular, and longest-lived modular phone undertaking in history. It all started in 2016 with the release of the Motorola Moto Z, one of the thinnest phones of all time and a real looker even by modern standards.
Drawing on experience from working on Google’s Project Ara, Motorola’s engineers developed a magnetic attachment system powered by pogo pins that used barely any space on the Moto Z’s slender body. The phone arrived with a wide selection of Moto Mods, including a power bank, a great-sounding JBL speaker, as well as more exotic add-ons such as a projector and a full-fledged point-and-shoot camera with a 10x zoom.
Credit: Motorola
Unlike other modular phone projects, Motorola provided a wide selection of Moto Mods at launch and greatly expanded the offering over the years. The company supported Moto Mods across four generations of Moto Z devices, with a total of 7 phones compatible with modular add-ons. Even some community-developed Moto Mods projects saw the light of day, like the slide-out keyboard mod.
Unfortunately, the Moto Mods project was abandoned in 2019, with the Moto Z4 being the last modular handset from Motorola. Despite its demise, Moto Mods left the deepest mark on the promise of modularity in Android, which still (kind of) lives on.
While not as exciting as other phones on this list, the Fairphone series of Android smartphones is the closest thing we’ve gotten to Google’s Project Ara. Aside from the original Fairphone, every member of the Fairphone family is an easy-to-repair, modular Android phone.
Instead of extra features, modular parts in Fairphone devices are there to allow for a high degree of repairability. They include the display, camera module with interchangeable lenses, an easy-to-replace battery, the SoC module, and modular daughterboards and flex cables.
Credit: Fairphone
They’re straightforward to remove and reattach, allowing owners to repair their phones by themselves from the comfort of their home. All you need are some screwdrivers and tweezers, spare parts you can order directly from the Fairphone spare parts shop, and you’re off to the races.
Despite being one of the easiest phones to repair, the latest Fairphone offering—the Fairphone 6—is anything but popular. It’s a niche device that the mainstream audience, as well as many enthusiasts, aren’t interested in, because being fully modular entails certain compromises (a plastic body, a mid-range chipset, cameras that trail high-end options, and more) that most phone users don’t want to deal with.
While the promise of modularity was exciting in the 2010s, the cold, harsh truth is that most of us will always choose high-end features and hard-to-repair unibody designs over sustainable, repairable modular phones.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
April 01, 2026
