🧰 PyPI

The items that name it 145

• Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
  articleas classification.technologies2026-10-26
• Mythos 5 Ignored Real-World Harm in July Attack
  articleas affected products2026-10-26It is written here as PyPI (target of a malicious package upload in the September incidents).

  target of a malicious package upload in the September incidents

• Brotlipocalypse
  writeupas classification.technologies2026-10-24
• The Hacker News (@TheHackersNews) on X
  threadas tools2026-10-24It is written here as PyPI (package index used to publish the malicious release).

  package index used to publish the malicious release

• Prasenjit Sarkar (@stretchcloud) on X
  threadas affected products2026-10-24It is written here as PyPI (distribution channel of the malicious wheels).

  distribution channel of the malicious wheels

• New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
  writeupas classification.technologies2026-10-23
• Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
  advisoryas classification.technologies2026-10-23
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeupas classification.technologies2026-10-23
• LiteLLM Compromised in Fresh Supply Chain Attack
  articleas classification.technologies2026-10-23
• Python Packages Vulnerable to Node2Shell
  writeupas classification.technologies2026-10-23
• Muscle AI (@themuscleai) on X
  threadas tools2026-10-22It is written here as PyPI (quarantined the malicious release).

  quarantined the malicious release

• SecureChap (@SecureChap) on X
  threadas classification.technologies2026-10-22
• LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials | Endor Labs
  writeupas classification.technologies2026-10-21
• Billy Lee (@billyozno) on X
  threadas classification.technologies2026-10-21
• litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
  writeupas classification.technologies2026-10-21
• LiteLLM Compromised, Steals Credentials
  writeupas classification.technologies2026-10-21
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  writeupas classification.technologies2026-10-21
• LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
  writeupas classification.technologies2026-10-21
• LiteLLM compromised again: infostealer and RAT found in version 1.107.0
  writeupas classification.technologies2026-10-21
• JFrog Security (@JFrogSecurity) on X
  advisoryas classification.technologies2026-10-21
• The OpenSourceMalware Show #26
  talkas classification.technologies2026-10-21
• LiteLLM supply chain compromise: What you need to know
  writeupas tools2026-10-21

  Distribution channel through which malicious litellm 1.107.0 was published

• Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain
  paperas classification.technologies2026-10-20
• lee1981 (@lee1981b) on X
  advisoryas classification.technologies2026-10-20
• MemTensor Compromise: Poisoned MemOS Releases on npm and PyPI
  articleas classification.technologies2026-10-18
• Why Your SCA is Always Wrong | Endor Labs
  articleas affected products2026-10-16It is written here as PyPI (Python package manager; requirements.txt declares dependencies).

  Python package manager; requirements.txt declares dependencies

• Godfather of AI and 400 Scientists Want AI Models Cut Off From the Internet
  articleas affected products2026-10-14It is written here as PyPI (received malicious package uploaded by Claude Mythos 5; landed on 15 systems before removal).

  received malicious package uploaded by Claude Mythos 5; landed on 15 systems before removal

• Agent Baseline Publishes Security Reference Architecture for Software Factories
  articleas affected products2026-10-13It is written here as PyPI (agents reached it directly, bypassing denied-package controls).

  agents reached it directly, bypassing denied-package controls

• State of Dependency Management 2025 | Endor Labs
  paperas classification.technologies2026-10-12
• New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs
  articleas affected products2026-10-12
• Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution | Blog | Endor Labs
  writeupas classification.technologies2026-10-12
• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas classification.technologies2026-10-09
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeupas classification.technologies2026-10-09
• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
  writeupas affected products2026-10-09

  Python package registry; publishing credentials (PYPI_PASSWORD, PYPI_USERNAME) targeted; package registry release history should be reviewed for unexpected versions.

• tensorlake NPM package compromised with Shai Hulud worm
  writeupas classification.technologies2026-10-08
• 2026 in LLMs (so far)
  talkas affected products2026-09-27It is written here as PyPI (Python Package Index).

  Python Package Index

• Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes
  writeupas classification.technologies2026-09-23
• MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack
  writeupas classification.technologies2026-09-23
• Novel supplychain.local Go worm appears
  writeupas classification.technologies2026-09-23
• The OpenSourceMalware Show #21
  talkas classification.technologies2026-09-17
• GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
  articleas classification.technologies2026-09-16
• Malicious Code in Open Source: How to Detect It Before You Ship | Blog | Endor Labs
  articleas affected products2026-09-11It is written here as PyPI (Python Package Index).

  Registry hosting malicious Python packages such as ttlo, gisi, Whatfuscator, bobikssf, versioneer, and azure-functions.

• SolarWinds took a nation-state. The next attack just needs an LLM and $5. | Blog | Endor Labs
  articleas affected products2026-09-11

  Ecosystem compromised by TeamPCP; litellm (95 million monthly PyPI downloads) was backdoored.

• AI-Generated Malware Risk: A Practical Guide for Developers | Blog | Endor Labs
  articleas affected products2026-09-11

  Open source package registry cited as vulnerable to AI-generated malicious packages and typosquatting

• Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
  articleas tools2026-09-10

  Public Python package registry used by Claude Mythos 5 to register an account and publish three malicious package versions

• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas classification.technologies2026-09-08
• vet (SafeDep)
  repoas affected products2026-09-07

  Package manager ecosystem supported/scanned by vet

• ForgeGuardian
  repoas affected products2026-09-05
• Hallucinated Packages: How AI Invents Dependencies Attackers Exploit | Blog | Endor Labs
  articleas classification.technologies2026-09-02
• Introducing deny list egress policies for Harden-Runner
  articleas affected products2026-09-02

  Default client fetches metadata from one host and downloads distributions from another; both are upstream destinations relevant to deny-list configuration.

• Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI | Blog | Endor Labs
  writeupas classification.technologies2026-08-31
• Dev Machine Guard Now Inventories Where Developer Credentials Live
  articleas classification.technologies2026-08-28
• The OpenSourceMalware Show #19
  talkas classification.technologies2026-08-28
• Customer Zero: Implementing Package Firewall at Endor Labs | Blog | Endor Labs
  articleas classification.technologies2026-08-25
• JFrog: Coding Agents Just Reopened Your Software Supply Chain Blind Spot
  articleas affected products2026-08-25
• Shai-Hulud was the best thing to happen to supply chain security
  articleas classification.technologies2026-08-24
• The State of Open Source Supply Chain Attacks
  articleas classification.technologies2026-08-23
• What is CVE remediation in 2026?
  articleas classification.technologies2026-08-21
• XBOW: Engineering the Impossible
  articleas classification.technologies2026-08-13
• npm Now Scans for Malware at Publish, Not Install | Blog | Endor Labs
  articleas affected products2026-08-12

  Package registry not covered by npm's publish-time scanning gate

• Control Which Package Registries Your CI Jobs and Developer Machines Use
  articleas classification.technologies2026-08-12
• Xygeni Malicious Code Digest 82
  articleas affected products2026-08-08

  Registry monitored/scanned for malicious packages

• [tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning
  articleas affected products2026-08-07It is written here as PyPI (malicious package published by Claude during evaluation).

  malicious package published by Claude during evaluation

• Cloud Threat Highlights: H1 2026
  writeupas affected products2026-08-06

  Package ecosystem targeted by TeamPCP (April-May variant) and the Hades variant.

• Who was behind the attack? Possibly nobody
  articleas affected products2026-08-05It is written here as PyPI (Python Package Index).

  Python Package Index

• Anthropic AI agent faked identities, phished real developers in UK government hacking test
  articleas classification.technologies2026-08-05
• Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It
  articleas classification.technologies2026-08-03
• Socket: Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic's Security Tests
  articleas tools2026-08-01

  Public Python package registry; its automated security systems detected and removed the malicious package

• Anthropic's Fever Dream: Claude's package that stole real keys
  writeupas affected products2026-07-31It is written here as PyPI (Python Package Index).

  Platform where the malicious 'anthropickit' package (version 999.9.9) was published and live for about an hour.

• Slopsquatting: When AI Agents Hallucinate Malicious Packages | Blog | Endor Labs
  articleas affected products2026-07-29

  public package registry where attackers register hallucinated package names loaded with malware

• AI-Generated Malware and the Software Supply Chain | Blog | Endor Labs
  articleas affected products2026-07-29

  Package registry scanned by Endor Labs' malware detection system for newly uploaded packages

• Dependency Confusion: How Attackers Poison Your Build | Blog | Endor Labs
  articleas affected products2026-07-29

  registry that hosted malicious torchtriton package for five days (Dec 2022)

• Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
  writeupas classification.technologies2026-07-25
• Homebrew 6.0.0 security update
  articleas classification.technologies2026-07-24
• Socket: New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs
  articleas affected products2026-07-23
• Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
  articleas affected products2026-07-23

  Registry publishing tokens targeted for theft; supports OIDC trusted publishing

• AI Security Briefing
  paperas classification.technologies2026-07-18
• AI Security Briefing
  articleas classification.technologies2026-07-18
• AI Security Briefing
  writeupas classification.technologies2026-07-18
• OpenSourceMalware Blog
  articleas affected products2026-07-18

  Ecosystem hit by typosquats containing prompt injection and by TeamPCP's LiteLLM compromise; Mini Shai-Hulud crossed into PyPI.

• FauxUV campaign (Xygeni)
  writeupas classification.technologies2026-07-18
• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas affected products2026-07-17

  Ecosystem PolinRider spread into

• Socket: Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping
  articleas affected products2026-07-17

  Hit by the Mini Shai-Hulud variant in April and May 2026.

• Socket: Coordinated npm/PyPI Campaign Typosquats Paysafe, Skrill, Neteller Payment SDKs
  writeupas classification.technologies2026-07-16
• How Aikido Intel detects malware and vulnerabilities first
  articleas classification.technologies2026-07-13
• AI Security Briefing
  advisoryas classification.technologies2026-07-13
• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  articleas classification.technologies2026-07-12
• GitHub Action Canaries
  repoas classification.technologies2026-07-11
• DataDog/guarddog
  repoas classification.technologies2026-07-11
• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas affected products2026-07-08

  Python projects Xpos587/git2md and Xpos587/markfetch under the Xpos587 GitHub account (seized June 23, 2026 ~10:00 UTC) were rewritten, but no malicious PyPI releases were observed, likely due to lacking publishing credentials or PyPI controls.

• AI Security Briefing
  advisoryas classification.technologies2026-07-05
• AI Security Briefing
  advisoryas classification.technologies2026-07-05
• Socket: PolinRider
  writeupas affected products2026-07-02It is written here as PyPI (Xpos587 account).

  No malicious releases observed from this maintainer's PyPI account

• And another one. GitHub ships break-glass credential revocation
  articleas classification.technologies2026-07-01
• Shipping post-quantum cryptography to Python
  writeupas classification.technologies2026-06-30
• Packagist is now protected by Aikido Intel and other updates to the PHP registry
  articleas classification.technologies2026-06-26
• Thinkst Package Proxy
  toolas affected products2026-06-26

  Python Package Index; source of 12 malicious packages found seven years ago; supported by Package Proxy

• Introducing GuardDog 3.0: new YARA rules engine, risk scoring, and sandboxing
  articleas affected products2026-06-26

  Package ecosystem scanned by GuardDog; used in examples (litellm malicious sample, requirements.txt scanning).

• The OpenSourceMalware Show #10
  talkas affected products2026-06-25
• Introducing Patch the Planet
  articleas affected products2026-06-22It is written here as PyPI (Warehouse).

  clearer admin-quarantine confirmation contributed

• Vulnerability-Lookup
  advisoryas classification.technologies2026-06-18
• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas classification.technologies2026-06-18
• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.technologies2026-06-12
• Miasma & Hades Worms
  writeupas classification.technologies2026-06-10
• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas classification.technologies2026-06-09
• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas classification.technologies2026-06-09
• The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
  writeupas classification.technologies2026-06-09
• Active Malware Campaigns in January-May 2026
  writeupas classification.technologies2026-06-08
• Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds
  writeupas classification.technologies2026-06-06
• Secret Scanning Dev Workstations with bagel + Fleet
  writeupas affected products2026-06-04

  Package manager cited as expanding workstation attack surface.

• The OpenSourceMalware Show #7
  talkas classification.technologies2026-06-03
• The Software Supply Chain Malware Landscape: January - May 2026
  articleas affected products2026-06-03

  Package ecosystem with 10,940 malicious threat records tracked; growth rate similar to npm.

• Why EDR and proxy won’t save you from supply chain malware
  articleas classification.technologies2026-06-02
• Socket: OSV Withdraws 157 Malware Reports
  articleas classification.technologies2026-05-28
• Socket: TrapDoor Crypto Stealer
  writeupas classification.technologies2026-05-26
• OSV
  toolas classification.technologies2026-05-25
• Bumblebee
  repoas classification.technologies2026-05-24
• Socket: AI Has Taken Over Open Source
  articleas affected products2026-05-23

  Ecosystem covered by Socket's package database

• Open Source Malware Podcast — episodes
  otheras affected products2026-05-22

  Typosquat packages containing prompt injection

• JFrog: The Governance Gap Between Your Policy and Your Pipeline
  articleas affected products2026-05-21

  Passed YUM in usage.

• Socket: Mini Shai-Hulud Hits @antv Ecosystem
  writeupas classification.technologies2026-05-20
• GitHub breached via a malicious VS Code extension: why developer devices are the real target
  articleas classification.technologies2026-05-20
• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas affected products2026-05-20

  Open source package ecosystem targeted by TeamPCP

• Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again!
  writeupas classification.technologies2026-05-19
• FOSSA: Mini-Shai-Hulud Mass Compromise
  writeupas classification.technologies2026-05-18
• One year of Opengrep: What we built and what’s next
  articleas classification.technologies2026-05-12
• The complete GitHub Actions security checklist
  articleas affected products2026-05-11

  Package registry; target of the Ultralytics malicious package publication.

• Pantheon-Security/medusa
  repoas classification.technologies2026-05-10
• Socket: pnpm 11 Adds Supply Chain Protection Defaults
  articleas affected products2026-05-07

  Ecosystem affected by the Mini Shai-Hulud supply chain campaign.

• PyPI Access Control Vulns Patched
  articleas affected products2026-05-06It is written here as PyPI (Python Package Index).

  Uses Warehouse, the open source Python application that handles package uploads, metadata validation, storage, and downloads for pip and other installers

• GitHub Actions Security Pt 1: Attacks & Defenses | Wiz Blog
  articleas classification.technologies2026-04-14
• AikidoSec/safe-chain
  repoas classification.technologies
• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas classification.technologies
• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
  articleas affected productsIt is written here as PyPI (Python Package Index).

  Also targeted by malicious packages documented by Unit 42 alongside npm

• Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
  articleas classification.technologies
• AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
  articleas classification.technologies
• Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
  articleas classification.technologies
• CVE-2026-18655: Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs
  advisoryas classification.technologies
• CVE-2026-16584: Improper handling of an initialization failure in AWS API MCP Server from 0
  advisoryas classification.technologies
• CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
  advisoryas classification.technologies
• PYPILINE: Malicious PyPI Package Detection via Suspicious API Knowledge and Agent Workflow
  paperas affected productsIt is written here as PyPI (Python Package Index).

  Open source software supply chain platform whose packages are the subject of malicious package detection

• shai-hulud-detect: multi-ecosystem npm/PyPI/Composer/Crates/Go/Hex/RubyGems supply-chain worm scanner
  repoas classification.technologies
• Supply Chain Firewall (Datadog)
  repoas affected productsIt is written here as PyPI (pip/pip3).

  package manager whose install commands are inspected by Supply Chain Firewall

• CVE-2026-49291 | THREATINT
  advisoryas classification.technologies
• Dev Machine Guard Now Supports Linux - StepSecurity
  articleas classification.technologies

In every workspace you can read 156