Tag: pypi compromise

2 Attack Reports | 0 Vulnerabilities

Attack reports

Latest PyPi Compromise

A supply chain attack targeting the Microsoft DurableTask Python client compromised versions 1.4.1, 1.4.2, and 1.4.3 on PyPi. The threat actor gained access through a compromised GitHub account previously linked to attacks, using stolen credentials to dump GitHub secrets containing PyPi tokens. The…

credential theft

supply chain attack

pypi compromise

aws ssm propagation

kubernetes lateral movement

password manager

transformers.pyz

Published: May 19, 2026

Downloadable IOCs: 7

Supply Chain Poisoning via PyPI Repository Compromise

Xinference, an open-source distributed AI model inference framework, suffered a supply chain attack when attackers compromised PyPI release credentials of maintainers and published three malicious versions (2.6.0, 2.6.1, 2.6.2) on April 22, 2026. The malicious code, encoded in Base64 layers within …

credential theft

supply chain attack

base64 encoding

cloud exploitation

pypi compromise

Published: April 27, 2026

Downloadable IOCs: 3

Click here to see more Attack Reports