Do Son The emSign CA certificate was pulled from certifi. A new Python security release updates pip to block MITM risks. Upgrade pip and uv now.
PyPI
A LiteLLM supply chain attack shipped a PyPI credential stealer in version 1.107.0 that grabs cloud, AI tool, and SSH secrets. Act now.
PyPI file hosting errors caused weeks of 502s. See how a Fastly CDN 502 error was traced to one cache node and fixed by August 28.
A massive PyPI supply chain attack has hit developers. Learn how Socket malware detection uncovered the Hades cluster stealing cloud credentials.
OceanLotus targets Python developers worldwide via PyPI supply chain attacks. New ZiChatBot malware hijacks Zulip APIs for invisible C2 traffic. Patch now!
Trend Micro uncovers QLNX, a fileless Linux RAT targeting AWS, NPM, and Kubernetes keys. Learn how its eBPF rootkit hides from even the deepest system scans.
Critical supply chain attack hits Xinference (v2.6.0-2.6.2). TeamPCP’s malware siphons cloud credentials and MLOps secrets. Audit your MLOps pipeline today.
North Korea’s "Contagious Interview" campaign expands to 1,700+ malicious packages across npm, PyPI, and more. Learn how to protect your dev environment.
95M-download LiteLLM library hijacked on PyPI. TeamPCP's backdoor steals cloud tokens and hijacks Kubernetes clusters. Check for version 1.82.8 now.
Malicious PyPI package "sympy-dev" impersonates SymPy to install XMRig miners via fileless execution. Check your dependencies immediately.
A malicious PyPI typosquat (spellcheckers) infected 950+ users. The package deploys an XOR-encrypted Python RAT via a hidden index file, granting full remote execution (exec()) and is linked to crypto scams.
Malicious packages across npm, PyPI, and RubyGems are exploiting Discord webhooks as stealthy, resilient C2 endpoints to exfiltrate developer config files and sensitive host data.
The malicious PyPI package SoopSocks masqueraded as a SOCKS5 proxy but secretly installed a Go-based backdoor with SYSTEM privileges, leaking system data to a Discord webhook.
A new phishing campaign is targeting PyPI maintainers with emails from a fraudulent pypi-mirror.org domain to steal credentials and compromise accounts.
A new report reveals a malicious Python package on PyPI that uses a stealthy dependency and DLL sideloading to deliver a multi-stage malware.
PyPI is now checking for expired domains to prevent "domain resurrection attacks," a major step in securing the Python Package Index from account takeovers.
PyPI is implementing new restrictions to reject problematic ZIP archives and protect against "parser confusion" attacks, which could bypass security checks and smuggle malicious files.
GitLab researchers uncovered a crypto scam on PyPI. Typosquatted Bittensor packages hijacked staking functions to silently drain users' crypto wallets.
A study reveals Python's ecosystem is a "labyrinth of dependencies" that propagates vulnerabilities. Over 145,000 packages are at risk, with urllib3 accounting for 41% of all exposures.
North Korea's Lazarus Group is waging a covert cyberespionage campaign, poisoning 234+ open-source packages on npm/PyPI to steal secrets from CI/CD pipelines and developer environments.
PyPI warns of a new phishing campaign using "pypj.org" to spoof its login page, tricking maintainers into revealing credentials. PyPI itself is not compromised.
Four open-source packages on npm and PyPI (56k+ downloads) are secretly deploying sophisticated spyware, performing webcam surveillance, keylogging, and credential theft.