PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting

about.gitlab.com | blog | #supply-chain | #malware | #credential-theft | #pypi | #python | #shai-hulud | #typosquatting
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GitLab researchers found five malicious PyPI packages, including typosquats of Flask, Requests, and NumPy, that deploy the Shai-Hulud worm via .pth files to steal CI/CD credentials.
Published
Collected

Related coverage

blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
durabletask: TeamPCP's Latest PyPi Compromise
TeamPCP hit durabletask 1.4.1-1.4.3, Microsoft's Durable Task client: a hijacked account dumped a GitHub-stored PyPI token to push malware that steals credentials, spreading via AWS SSM.
blog · wiz.io
Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign
TeamPCP trojanized LiteLLM with malicious PyPI versions 1.82.7 and 1.82.8: the payloads abuse Python's .pth mechanism to run base64 payloads at startup, exfiltrating cloud and CI/CD credentials.
blog · netspi.com
3 Software Supply Chain Risks in 2023
Software supply chain attacks in 2023 cluster into three categories: package manager attacks like dependency confusion and typosquatting, developer compromise, and breaches at large software vendors.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
incident · blog.trailofbits.com
Supply chain attacks are exploiting our assumptions
From typosquatting to poisoned pipelines, supply chain attacks exploit implicit trust in package registries; tools like TypoGard, Zizmor, and PyPI Trusted Publishing make trust verifiable.
Back