Threat actors compromised the PyTorch Lightning package on PyPI and pushed malicious versions 2.6.2 and 2.6.3 that auto-execute on import to deploy a Bun runtime and an obfuscated JavaScript payload for credential theft. The campaign validates and abuses stolen GitHub tokens to inject worm-like commits (impersonating Anthropic's Claude Code), leverages an...

TeamPCP compromised the official Telnyx PyPI package by publishing backdoored versions 4.87.1 and 4.87.2 that install credential‑stealing malware hidden via steganography in WAV files and deploy second‑stage payloads to exfiltrate SSH keys, cloud tokens, wallets, and other secrets. Researchers (Aikido, Socket, Endor Labs) attribute the supply‑chain attack to TeamPCP, advise rolling back to Telnyx 4.87.0, treating any importer as fully compromised, and rotating all secrets immediately. #TeamPCP #Telnyx

In March 2026 attackers trojanized the popular Python library LiteLLM by uploading malicious versions to PyPI and OpenVSX that executed Base64-encoded payloads to collect secrets and deploy further stages. The malware harvested local files and cloud runtime credentials (including AWS IMDS), sought crypto wallets, established persistence locally and in Kubernetes, and exfiltrated encrypted archives to a remote C2. #LiteLLM #Checkmarx

TeamPCP has compromised the popular Python package litellm, publishing backdoored versions 1.82.7 and 1.82.8 on PyPI that include a credential harvester, a Kubernetes lateral-movement toolkit, and a persistent systemd backdoor. The malicious code executes automatically via an import-time injection and a .pth autorun, exfiltrates harvested data to models.litellm[.]cloud as "tpcp.tar.gz", and...

AI coding assistants hallucinate nonexistent package names that can be pre-registered on PyPI to deliver malicious install hooks and gain shell access. Combined with AI-generated hardcoded credentials and missing authentication checks, these issues can chain into full compromises of infrastructure and applications; implement dependency verification, secrets scanning, and auth middleware as a kill switch. #PyPI #AWS

CVE-2026-27641 is a critical security vulnerability identified in the flask-reuploaded Python package, versions prior to 1.5.0. Flask-Reuploaded is a Flask extension that facilitates file uploads in web applications. The vulnerability is cl

This week the Python Software Foundation explained how they keep Python secure. A new blog post recognizes the volunteers and paid Python Software Foundation staff on the Python Security Response Team (PSRT), who "triage and coordinate vulnerability reports and remediations keeping all Python users...

Blog com notícias sobre, Linux, Android, Segurança , etc

Malicious PyPI package 'solana-token' steals Solana developer code and secrets; update your systems! #SolanaSecurity #SupplyChainAttack #PythonSecurity

Un paquete malicioso recién descubierto en PyPI, llamado 'disgrasya' que abusa de tiendas legítimas de WooCommerce para validar tarjetas de crédito robadas,

Urgent: Malicious Python packages on PyPI steal sensitive data; over 39,000 downloads affected. #PythonSecurity #PyPI #Cybersecurity

Fake DeepSeek Python packages stole user data from PyPI; new archival feature added. #PyPI #PythonSecurity #SoftwareSupplyChain