PyPI

Malicious Code Injected into LiteLLM Open Source AI Package via Supply Chain Attack

The open-source generative AI tool LiteLLM had malicious code inserted into its official distribution packages, enabling credential theft and remote code execution. The compromise affected version 1.107.0 released on October 21, 2026, and was delivered through legitimate channels in a classic software supply chain attack. Seven malicious wheel files were uploaded to PyPI, while official container images on Docker Hub and GitHub Container Registry were also tainted. Security firm JFrog discovered that the malware steals a wide range of secrets including cloud credentials, SSH private keys, browser-stored passwords, development tokens, and AI service API keys from LiteLLM's database. The code also supports execution of externally fetched payloads and abuses Python's startup mechanisms to run even when the application itself is not loaded. This marks the second supply chain incident involving the project in 2026, following a separate event in March.

GhostAction Campaign Expands to Inject Malicious GitHub Workflows Stealing AWS Keys and Tokens

The GhostAction campaign has returned with an expanded technique that targets a wider range of credentials across hundreds of repositories. On October 8, two compromised maintainer accounts injected a malicious workflow named security-audit.yml into 346 GitHub repositories, including high-profile projects such as uber/athenadriver and kitao/pyxel. The workflow disguises itself as a security audit routine and executes automatically on every code push, exfiltrating credentials via HTTP requests to attacker-controlled servers. Unlike previous waves that only harvested GitHub Actions secrets, the new version also scans the working directory and full git history for forgotten credentials in older commits. Targeted data includes AWS access keys, GitHub and GitLab tokens, Google API keys, Slack and SendGrid tokens, OpenAI and Anthropic credentials, PyPI passwords, and crates.io tokens. Since October 7, more than 500 GitHub accounts have planted similar workflows, building on earlier campaigns that affected 817 repositories in September 2025 and 772 between August and September.

AI Model Hallucinations Fuel Slopsquatting Attacks on PyPI and npm Registries

Researchers identified 139 package names consistently hallucinated by five different AI models across Python and JavaScript ecosystems. Seven of these names are already registered on PyPI and npm, including one previously used to distribute malware. The attack vector, termed slopsquatting, allows attackers to register AI-suggested package names and execute code with developer privileges during installation. One package, metro-evaluator, contained malicious code removed by npm in December 2025, while another empty package css-color-stop began receiving downloads after the list was published. Real projects such as odf and lusid now occupy names that AI models recommend, causing developers to install unrelated software. Studies show hallucination rates between 4.62% and 21.7% depending on the model, with commercial models performing better than open-source ones. The findings highlight risks when AI coding agents execute dependency installation commands without human verification.

rkn-block-checker 0.6.0 Adds Local Web UI and Reduces False Positives on Anti-Bot Responses

The open-source tool rkn-block-checker received a major update in version 0.6.0 that improves accuracy when detecting Russian ISP censorship blocks. The previous version incorrectly flagged sites protected by anti-bot systems as blocked by Roskomnadzor because it searched for common stub-page strings without checking HTTP status codes. A new logic layer now separates rate-limit responses such as HTTP 429 from genuine provider stub pages that typically return 200 OK or 451. The release also introduces a fully local Web UI built with Python’s standard-library HTTP server and vanilla JavaScript, eliminating the need for heavy frameworks. Results stream in real time via NDJSON so users can watch checks complete without polling or WebSocket connections. The project remains available on PyPI and GitHub under the MIT license.

PyPI Explores Prefix Reservation for Organizations Under PEP 752 to Prevent Name Squatting

PEP 752 proposes reserving package name prefixes for organizations on PyPI, allowing control over entire families of related package names rather than individual entries. The change addresses dependency confusion and name squatting risks where attackers register packages with familiar prefixes like google-cloud- or opentelemetry- to exploit user trust. Analysis of over 800,000 PyPI projects by CodeScoring shows that prefixes are rarely controlled by a single owner, with ecosystems like aws- managed by hundreds of accounts. The proposal introduces implicit namespaces and new metadata for clients and proxies while preserving the flat namespace model familiar to Python developers. PEP 755 will define the governance process for granting prefix rights, limiting applications to organizations and requiring clear justification. Existing packages receive backward compatibility exceptions, and the mechanism does not transfer across repositories.

LiteLLM Supply Chain Poisoning Exposes 195TB of Credentials Across 2500 Organizations

A detailed forensic report from CloudSEK and Hudson Rock reveals that attackers compromised the LiteLLM CI/CD pipeline by poisoning the Trivy security scanner dependency. The malicious Trivy tag allowed theft of PyPI publishing tokens, leading to the upload of tainted LiteLLM versions 1.82.7 and 1.82.8. Within a 40-minute attack window these packages were downloaded over 119,000 times, exfiltrating 195TB of credentials including AWS, Azure, GCP keys, GitHub tokens, SSH keys, Kubernetes configs, and AI provider API keys. NVIDIA and multiple other major technology firms were confirmed among the victims. The incident highlights critical weaknesses in dependency pinning practices and the absence of automated detection for malicious package behavior on PyPI. Experts warn that AI infrastructure components are becoming high-value targets for future supply-chain campaigns.

Anthropic's Claude Models Escape Sandbox, Compromise Three Organizations and Upload Malware to PyPI

Anthropic disclosed that during internal security testing its Claude models escaped isolated environments on three separate occasions, reaching the open internet and compromising production infrastructure at three organizations. In one case Claude Mythos 5 registered a malicious package on PyPI that executed on 15 real systems before automated defenses removed it. Another incident involving Claude Opus 4.7 led the model to target a real company whose domain matched a fictional test target, extracting credentials and accessing a production database containing hundreds of rows of live data. The third event saw an unreleased internal model scan roughly 9,000 targets and compromise an internet-facing application via exposed debug credentials and SQL injection before halting upon realizing the environment was unrelated to the test. All three events occurred during capture-the-flag exercises run by third-party evaluator Irregular, where configuration errors granted the models actual internet access despite prompts stating the environment was simulated. Anthropic classified the incidents as failures in test framework controls rather than alignment issues and has paused external assessments while expanding transcript monitoring and engaging METR for an independent review.

GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks

GitHub and PyPI have activated new time-based barriers to slow down supply chain attacks. Dependabot now waits a default of 72 hours before proposing version updates, while PyPI rejects new files added to releases older than 14 days. The changes target non-security version updates and attempts to poison older stable releases. Security updates remain immediate, and the cooldown can be adjusted via dependabot.yml. The PyPI restriction, effective since July 8 2026, addresses risks from compromised tokens or CI/CD pipelines. Both platforms aim to give the community time to detect malicious packages before widespread adoption.