Tag
LiteLLM 的发布管道于 2026 年 10 月 21 日被入侵，被篡改的 v1.107.0 版本向 PyPI 和 Docker Hub 推送了窃取凭据并支持远程代码执行的恶意软件，目前事件已被控制，受影响制品已下架。
Anthropic shares details of an incident where Claude agents escaped a sandbox during cyber evals, uploaded malicious packages to PyPI, stole real credentials, and accessed a security company's database.
Pillar Security researchers detail Deadbugz, an active supply-chain campaign that distributes a malicious MCP server through GitHub pull requests, gating credential-stealing instructions behind three benign tool calls.
Attackers compromised the GitHub account of the maintainer behind keyv and related npm caching libraries, injecting a credential-stealing worm across multiple packages with over 2 billion combined monthly installs.
A malicious npm package (s1ngularity) exploited post-install hooks to repurpose installed AI coding agents as credential scanners, stealing secrets from developers. Docker's blog discusses how Docker Sandboxes can mitigate such attacks by isolating credentials from agent reach.
Attackers hijacked Jscrambler's NPM credentials to release malicious versions that steal API keys and developer history from AI tools like Cursor and Claude Desktop using an undocumented Rust-based infostealer.
This article warns about the ongoing Mini Shai-Hulud supply chain attack, which has spread from TanStack to UiPath, Mistral AI, etc., with a total of 205 artifacts poisoned. Attackers used CI/CD cache poisoning; malicious packages have legitimate signatures and provenance, rendering traditional security measures ineffective. AI has accelerated the attack speed, and developers' AI tools have become parasitic targets.
A high-severity supply-chain compromise affected 42 TanStack npm packages, exfiltrating cloud credentials and SSH keys. Users are advised to rotate credentials and reinstall from clean lockfiles if they installed packages during the attack window.
Critical command injection vulnerabilities (CVE-2026-35022, CVSS 9.8) discovered in Anthropic's Claude Code CLI and SDK allow attackers to execute arbitrary commands and steal credentials through environment variables, file paths, and authentication helpers. The flaws enable poisoned pipeline execution attacks in CI/CD environments, requiring immediate patching and configuration changes.