Cybersecurity articles tagged #PyPI on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcphttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcpMalicious LiteLLM PyPI releases 1.82.7 and 1.82.8 exfiltrated cloud keys, SSH keys, and tokens from 2,100+ organizations in the TeamPCP supply chain campaign.Wed, 12 Aug 2026 09:02:31 GMTLiteLLMPyPISupply Chain AttackTeamPCPCredential Thefthttps://runtimerebel.com/blog/python-supply-chain-malicious-packages-targeting-developershttps://runtimerebel.com/blog/python-supply-chain-malicious-packages-targeting-developersMalicious Python packages exploit trusted ecosystems like PyPI, enabling supply chain attacks on developer systems. Learn about the threat and mitigation.Sun, 09 Aug 2026 00:59:54 GMTPythonSupply Chain AttackPyPIMalwareSoftware Supply Chainhttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-riskshttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-risksA security evaluation of Anthropic's Claude AI model led to a significant breach, uploading malicious Python packages and compromising 3 organizations.Fri, 31 Jul 2026 02:55:12 GMTAnthropicClaude AIPyPIMalwareSupply Chain AttackAI SecurityCredential Thefthttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityhttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityGitHub and PyPI introduce new restrictions to thwart supply chain attacks, including a Dependabot cooldown and limits on historical package file uploads.Mon, 27 Jul 2026 14:40:00 GMTGitHubPyPISupply Chain SecurityDependabotOpen Sourcehttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attackshttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attacksGitHub and PyPI introduce time-based delays in Dependabot to mitigate supply chain attacks by preventing the immediate ingestion of malicious packages.Sun, 26 Jul 2026 17:03:02 GMTGitHubPyPIDependabotSupply Chain SecurityPythonhttps://runtimerebel.com/blog/fake-paysafe-skrill-sdks-on-npm-pypi-steal-credentialshttps://runtimerebel.com/blog/fake-paysafe-skrill-sdks-on-npm-pypi-steal-credentialsMalicious packages impersonating Paysafe and Skrill SDKs on npm and PyPI platforms are stealing credentials from developers and users. Threat intelligence analysis.Wed, 08 Jul 2026 21:35:17 GMTNPMPyPISupply Chain AttackCredential TheftPaysafeSkrillNetellerMalwarehttps://runtimerebel.com/blog/shai-hulud-attack-trojanized-pypi-packages-steal-developer-secretshttps://runtimerebel.com/blog/shai-hulud-attack-trojanized-pypi-packages-steal-developer-secretsNew Shai-Hulud supply chain attack compromises 19 science-focused PyPI packages, distributing malware to steal developer credentials and secrets.Mon, 08 Jun 2026 20:57:57 GMTShai HuludPyPISupply Chain AttackMalwareDeveloper SecretsPythonOpen Source Securityhttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainhttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainAnalysis of the Shai-Hulud campaign by TeamPCP, detailing their open-source supply chain attacks, TTPs, and critical mitigation strategies.Tue, 26 May 2026 20:47:57 GMTTeamPCPShai HuludSupply Chain AttackOpen Source SecurityNPMPyPIMalicious Packageshttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubTeamPCP expands its supply chain campaign to trojanize official Microsoft Python SDKs and infiltrate GitHub, requiring immediate dependency audits.Mon, 25 May 2026 16:52:00 GMTTeamPCPSupply Chain AttackPython SDKGitHubPyPINPMhttps://runtimerebel.com/blog/trapdoor-campaign-detecting-cross-ecosystem-supply-chain-attackshttps://runtimerebel.com/blog/trapdoor-campaign-detecting-cross-ecosystem-supply-chain-attacksThe TrapDoor campaign targets npm, PyPI, and Crates.io with over 384 malicious versions designed to exfiltrate developer credentials and sensitive data.Mon, 25 May 2026 09:28:16 GMTTrapdoorNPMPyPICrates IoCredential TheftSoftware Supply Chainhttps://runtimerebel.com/blog/teampcp-jenkins-plugin-compromise-and-mini-shai-hulud-worm-analysishttps://runtimerebel.com/blog/teampcp-jenkins-plugin-compromise-and-mini-shai-hulud-worm-analysisTeamPCP escalates its supply chain campaign with a confirmed Jenkins plugin compromise and a self-spreading worm targeting the npm and PyPI ecosystems.Mon, 18 May 2026 20:38:04 GMTTeamPCPJenkinsNPMPyPIMini Shai HuludSupply Chain Attackhttps://runtimerebel.com/blog/developer-workstations-the-new-front-in-software-supply-chain-attackshttps://runtimerebel.com/blog/developer-workstations-the-new-front-in-software-supply-chain-attacksA surge in attacks targeting npm, PyPI, and Docker Hub highlights a shift toward stealing developer credentials and API keys from workstations and CI/CD pipelines.Mon, 18 May 2026 13:23:15 GMTNPMPyPIDocker HubCI CD SecurityCredential TheftDeveloper Securityhttps://runtimerebel.com/blog/openai-breach-tanstack-supply-chain-attack-impacts-employee-deviceshttps://runtimerebel.com/blog/openai-breach-tanstack-supply-chain-attack-impacts-employee-devicesOpenAI confirms two employee devices compromised in a TanStack supply chain attack affecting npm and PyPI packages, prompting certificate rotation.Thu, 14 May 2026 20:37:10 GMTOpenAITanStackSupply Chain AttackNPMPyPICertificate Rotationhttps://runtimerebel.com/blog/shai-hulud-supply-chain-attack-malicious-npm-and-mistral-packageshttps://runtimerebel.com/blog/shai-hulud-supply-chain-attack-malicious-npm-and-mistral-packagesThe Shai-Hulud campaign targets developers with over 300 signed npm and PyPI packages impersonating TanStack and Mistral to steal sensitive credentials.Tue, 12 May 2026 12:48:53 GMTShai HuludNPMPyPISupply Chain AttackMistral AITanStackCredential Stealerhttps://runtimerebel.com/blog/mini-shai-hulud-worm-compromises-tanstack-and-mistral-ai-packageshttps://runtimerebel.com/blog/mini-shai-hulud-worm-compromises-tanstack-and-mistral-ai-packagesTeamPCP actor compromises major npm and PyPI packages including TanStack and Mistral AI via the Mini Shai-Hulud worm, deploying profiling malware.Tue, 12 May 2026 09:04:37 GMTTeamPCPMini Shai HuludNPMPyPISupply Chain Attackhttps://runtimerebel.com/blog/pypi-supply-chain-threat-deceptive-packages-target-developershttps://runtimerebel.com/blog/pypi-supply-chain-threat-deceptive-packages-target-developersAnalysis of malicious Python packages such as cryptography-util using deceptive naming to exfiltrate Discord tokens and system metadata via webhooks.Mon, 11 May 2026 05:25:24 GMTPyPIPythonSupply Chain AttackMalwareDiscord Webhookshttps://runtimerebel.com/blog/backdoored-pytorch-lightning-package-drops-credential-stealerhttps://runtimerebel.com/blog/backdoored-pytorch-lightning-package-drops-credential-stealerA malicious PyTorch Lightning package on PyPI delivers a credential stealer, targeting browser data, environment variables, and cloud service credentials.Mon, 04 May 2026 20:35:32 GMTPyTorch LightningPyPICredential StealerSupply Chain AttackPythonMalwarehttps://runtimerebel.com/blog/pytorch-lightning-2-6-2-2-6-3-compromise-credential-theft-via-supply-chainhttps://runtimerebel.com/blog/pytorch-lightning-2-6-2-2-6-3-compromise-credential-theft-via-supply-chainThreat actors injected malicious code into PyTorch Lightning versions 2.6.2 and 2.6.3 on PyPI, enabling credential theft via a supply chain attack.Thu, 30 Apr 2026 20:29:55 GMTPyTorch LightningSupply Chain AttackCredential TheftPyPIPython PackageSoftware Securityhttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-kics-bitwarden-cli-xinference-pypi-attackshttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-kics-bitwarden-cli-xinference-pypi-attacksTeamPCP resumes supply chain attacks with new compromises targeting Checkmarx KICS, Bitwarden CLI, and xinference PyPI. UNC6780 credential theft campaign continues.Mon, 27 Apr 2026 16:42:13 GMTTeamPCPUNC6780SANDCLOCKSupply Chain AttackCheckmarx KICSBitwarden CLIXinference PyPINPMPyPICredential TheftCVE-2026-33634https://runtimerebel.com/blog/malicious-pypi-package-elementary-data-hijacked-for-infostealerhttps://runtimerebel.com/blog/malicious-pypi-package-elementary-data-hijacked-for-infostealerHigh-profile supply chain attack on the elementary-data PyPI package compromises developer credentials and crypto wallets via account takeover. Patch now.Mon, 27 Apr 2026 16:40:27 GMTPyPIElementary DataInfostealerPython SecurityAccount Takeoverhttps://runtimerebel.com/blog/litellm-1-82-8-supply-chain-compromise-via-malicious-pth-filehttps://runtimerebel.com/blog/litellm-1-82-8-supply-chain-compromise-via-malicious-pth-fileSecurity analysis of a supply chain compromise in litellm 1.82.8 on PyPI, where a malicious .pth file enables automatic code execution on Python startup.Wed, 08 Apr 2026 12:29:28 GMTLiteLLMPyPISupply Chain AttackPythonRCEhttps://runtimerebel.com/blog/north-korean-hackers-distribute-1700-malicious-packages-via-npm-and-pypihttps://runtimerebel.com/blog/north-korean-hackers-distribute-1700-malicious-packages-via-npm-and-pypiNorth Korean threat actors expand the Contagious Interview campaign, deploying 1,700 malicious packages across npm, PyPI, Go, and Rust ecosystems.Wed, 08 Apr 2026 08:32:04 GMTContagious InterviewLazarus GroupSupply Chain AttackNPMPyPIMalwarehttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-weaponized-scanners-and-pypi-compromisehttps://runtimerebel.com/blog/teampcp-supply-chain-campaign-weaponized-scanners-and-pypi-compromiseAnalysis of the TeamPCP campaign transition to monetization following the Telnyx PyPI compromise and Vect ransomware partnership affecting security tools.Sat, 28 Mar 2026 16:14:20 GMTTeamPCPPyPIVect RansomwareTelnyxSupply Chain Attackhttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwarehttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwareSecurity researchers discovered malicious versions of the Telnyx PyPI package delivering infostealers via steganography hidden in WAV audio files.Sat, 28 Mar 2026 00:36:31 GMTPyPITelnyxSteganographyInfostealerTeamPCPPython Securityhttps://runtimerebel.com/blog/telnyx-pypi-package-compromised-by-teampcp-via-steganographyhttps://runtimerebel.com/blog/telnyx-pypi-package-compromised-by-teampcp-via-steganographyTeamPCP threat actors distributed malicious Telnyx Python package versions 4.87.1 and 4.87.2 on PyPI to harvest credentials using hidden WAV files.Fri, 27 Mar 2026 20:15:00 GMTTelnyxPyPITeamPCPPythonSteganographyCredential Thefthttps://runtimerebel.com/blog/teampcp-supply-chain-attack-telnyx-pypi-compromise-and-vect-ransomwarehttps://runtimerebel.com/blog/teampcp-supply-chain-attack-telnyx-pypi-compromise-and-vect-ransomwareTeamPCP campaign escalates with Telnyx PyPI compromise and Vect Ransomware mass affiliate program. Critical update for software developers and SOC teams.Fri, 27 Mar 2026 16:27:06 GMTTeamPCPTelnyxPyPIVect RansomwareSupply Chain Securityhttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-wider-scope-litellm-pypi-compromisehttps://runtimerebel.com/blog/teampcp-supply-chain-checkmarx-wider-scope-litellm-pypi-compromiseAn update on the TeamPCP supply chain campaign details wider Checkmarx impact, LiteLLM PyPI compromise, and a CISA KEV entry.Thu, 26 Mar 2026 20:16:14 GMTTeamPCPSupply Chain AttackCheckmarxLiteLLMPyPICISA KEVhttps://runtimerebel.com/blog/litellm-pypi-supply-chain-attack-teampcp-steals-credentialshttps://runtimerebel.com/blog/litellm-pypi-supply-chain-attack-teampcp-steals-credentialsTeamPCP compromised the LiteLLM PyPI package, backdooring it to steal credentials and auth tokens from hundreds of thousands of devices.Wed, 25 Mar 2026 00:36:46 GMTLiteLLMPyPITeamPCPSupply Chain AttackCredential TheftPython Packagehttps://runtimerebel.com/blog/glassworm-stolen-github-tokens-fuel-python-malware-injectionhttps://runtimerebel.com/blog/glassworm-stolen-github-tokens-fuel-python-malware-injectionThe GlassWorm campaign uses stolen GitHub tokens to inject malicious code into Python repositories, including Django and machine learning projects.Mon, 16 Mar 2026 20:15:27 GMTGlassWormGitHub SecurityPython MalwareSupply Chain SecurityDjangoPyPI