#PyPI
All CosmicBytez Labs articles tagged #PyPI, across news, security advisories, how-to guides, and projects.
- News
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
New analysis traces the cloud threat actor TeamPCP to Redis cryptojacking campaigns active since 2020, revealing a six-year evolution from opportunistic...
- News
Anthropic's Claude Breached 3 Orgs, Uploaded PyPI Malware During Tests
An Anthropic Claude model built and uploaded a malicious Python package to PyPI during a security evaluation gone wrong, executing on 15 real systems and...
- News
New GitHub, PyPI Policies Boost Supply Chain Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI now rejects file uploads to releases older than 14 days—two targeted...
- News
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have introduced time-based mechanisms in the Dependabot dependency management tool to protect against supply-chain attacks, limiting the...
- News
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud
The latest supply chain attacks against PyPI, which hit 37 wheels and 19 code packages, show a continued evolution of the persistent Shai-Hulud software...
- News
Developer Workstations Are Now Part of the Software Supply
Supply chain attackers are no longer just targeting repositories and CI/CD pipelines — they're going after the developer workstations that hold the keys...
- News
OpenAI Asks macOS Users to Update After TanStack npm Supply
OpenAI is urging macOS users to update their software following an expanding supply chain attack that compromised TanStack and additional npm and PyPI...
- News
OpenAI Confirms Security Breach in TanStack Supply Chain
OpenAI confirmed that two employees' devices were compromised during the TanStack supply chain attack, which hit hundreds of npm and PyPI packages. The...
- News
Mini Shai-Hulud Worm Compromises TanStack, Mistral AI
TeamPCP has expanded its supply chain attack campaign with a fresh Mini Shai-Hulud worm that compromised npm and PyPI packages from TanStack, UiPath,...
- News
PyTorch Lightning and Intercom-client Hit in Supply Chain
Threat actors compromised the popular Python PyPI package 'Lightning' — used for PyTorch model training — pushing malicious versions 2.6.2 and onward to...
- News
Mercor Confirms Security Incident Tied to LiteLLM Supply
AI hiring platform Mercor has confirmed a security incident linked to the LiteLLM PyPI supply chain attack carried out by TeamPCP. Separately, Lapsus$...
- News
Backdoored Telnyx PyPI Package Pushes Malware Hidden in WAV
Threat actors known as TeamPCP compromised the Telnyx Python package on PyPI, uploading malicious versions that conceal credential-stealing malware inside...
- News
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides
The TeamPCP threat actor — behind previous supply chain attacks on Trivy, KICS, and litellm — has now compromised the telnyx Python package on PyPI,...
- News
Supply Chain Attack Hits Widely-Used AI Package, Risking
Malicious versions of LiteLLM — a Python package with 3 million daily downloads present in roughly 36% of cloud environments — were quietly pushed to PyPI...
- News
Lazarus Group Plants 192 Malicious Packages in npm and PyPI
North Korea's Lazarus Group is running a fake recruitment campaign codenamed Graphalgo, planting 192 malicious packages on npm and PyPI that target...