litellm 1.107.0 shipped a credential stealer and an hourly remote code loader in all seven PyPI wheels and the official Docker images. The attacker hijacked BerriAI's release workflow with a GitHub ...
Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual ...
The workflow is disguised as a security improvement and exfiltrates two categories of data to a hardcoded IP address over plain HTTP: the repository's named GitHub Actions secrets, and every cloud, AI ...
Why this matters Developers link AI provider accounts to OpenCode so the agent can call models on their behalf. If those linked credentials were exposed, an attacker could run inference against the ...
The malicious release was built from the project's own main branch and published with an npm provenance attestation. On October 5, 2026, StepSecurity analyzed @subql/common@5.8.3 on npm and identified ...
On October 5, 2026, StepSecurity analyzed @subql/common@5.8.3 on npm and identified a hidden payload that collects credentials and supports remote shell access. It starts during installation and when ...
A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in multiple targets. The attacker, an autonomous bot called ...
StepSecurity's AI Package Analyst and Harden-Runner detected the compromise of axios, the largest npm supply chain attack on a single package by download count, before any public disclosure existed.
GitGuardian researchers discover massive supply chain attack affecting 817 repositories across 327 GitHub users. Malicious workflows exfiltrated 3,325 secrets including PyPI, npm, and DockerHub tokens ...
Introducing Secure Registry by StepSecurity: install-time defense for the npm supply chain. Block malicious packages, enforce package cooldowns, and protect CI/CD pipelines, developer machines, and ...
For MemoryOS 2.0.34, include hosts where a normal import could reach logging initialization. Remove or quarantine the affected release and use an independently vetted replacement; this inspection did ...
On June 8, 2026, multiple Graph ML PyPI packages in the bioinformatics ecosystem were compromised in the Hades campaign, deploying cross-platform memory scrapers, AI prompt injections to misdirect ...
Results that may be inaccessible to you are currently showing.
Hide inaccessible results