) that was infected with the self-propagating Shai-Hulud worm. On October 8, 2026, the npm package tensorlake...0.5.144 carrying a malicious payload from the Shai-Hulud worm family. The package is the official TypeScript...ready to take the next step in securing your software supply…
tensorlake. This article goes into detail on this malicious package based on information we observed and analyzed
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and...Denver — Depending on a software bill of materials (SBOM) to determine what happens when a malicious package slips past security checks can leave defenders...Kanjani used a…
package has been compromised as part of a software supply chain attack that delivered a credential stealer...organization so as to prevent further publication of malicious packages. Analysis of the malicious version shows...compromise that took place as part of…
GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. LiteLLM was compromised in a fresh supply chain attack, and malicious packages were served to its users on both PyPI and...routing requests across LLM providers.
being impacted in the attack. [Related: 3CX Supply Chain Attack: 8 Biggest Things To Know] That’s the nature of software supply chain breaches, and why they are so alarming:
dependency-install practices. - The attacker compromised maintainer jasonsaayman's npm account, changed...variable. - The dropper deleted itself and the malicious package manifest, then installed a clean v4.2.0 manifest
0.5.144 has been compromised in a ChainDrop supply chain attack delivering an obfuscated, credential-stealing...Zed. The compromise mirrors tactics seen in the Shai-Hulud campaign against keyv and cacheable. Self-propagation
Home > Blog > LiteLLM 1.107.0 Supply Chain Attack: Malicious Code Found in PyPI Package A...analyzed package, this should be treated as a malicious package compromise rather than simply suspicious
archive stolen during an earlier LiteLLM supply chain attack, in March, and linked it to 2,488 corporate...the impacted releases have been pulled.” The malicious package stayed on PyPI from 11:39 to 13:23 UTC, while
Malicious packages on npm and PyPI, dependency confusion, typosquatting, SBOMs, SLSA, signed builds and compromised maintainers.
An article joins this feed when it matches these terms. Each one is also a search of its own.