Unpinned MCP server launches can expose API keys, Corelight finds
Of 35 servers reviewed, 23 recommended installs pulled fresh registry dependencies; pinning the main package did not lock the rest.
Stories per day · 30 days
2 RSS
Relatedsupply-chain25litellm18docker11credential-theft10infostealer6credential-stealer4github-actions3llmjacking3npm3open-source3python3attestations2ghostaction2github2mcp2ai-agents1ai-assistants1aws1
44 stories, newest first · one card per story
Stories tagged #pypi
PyPI project pages now show provenance and security warnings
The security tab shows per-file attestations and flags incomplete, inconsistent, changed, or lost provenance before install.
GhostAction variant steals secrets via workflows in tens of thousands of GitHub repos
Accounts henrywoo and kitao added the workflow on October 8; it exfiltrates secrets over HTTP and scans Git history.
LiteLLM supply chain attack began with an unrevoked GitHub master key
Poisoned release 1.107.0 carried an infostealer and remote access trojan and drew about 49,000 downloads before PyPI quarantined it.
Unrevoked LiteLLM key used to publish credential-stealing PyPI package
Microsoft said the malware ran on every Python startup, and stolen AWS keys were checked against Amazon AI models.
Brotli 1.2.1 published for CVE-2026-111497
An oss-security reply says a report also covers the issue and that PyPI brotli packages were added to a vulnerable-package list.
Leaked LiteLLM master key used to steal GitHub tokens and publish malicious 1.107.0
An unrevoked Agent Platform key from May let an attacker publish LiteLLM 1.107.0 to PyPI on October 21; PyPI later quarantined it.
4
LiteLLM GitHub secrets taken 11 days before malicious package release
October 10 and 12 workflows posted CI secrets to webhook.site; a key committed May 27 was never revoked.
2
Compromised LiteLLM 1.107.0 steals credentials via Python startup
Starting Python with the package installed can run PRIVCOLLECT without importing LiteLLM; removing the package does not recover credentials.
Malicious LiteLLM 1.107.0 packages hit PyPI and Docker Hub
The poisoned build was online about three hours, downloaded over 49,000 times, and the latest clean release is 1.106.2.
3
LiteLLM release pipeline hacked to distribute info-stealer malware
Malicious LiteLLM 1.107.0 wheels and images were live for hours on October 21; roll back to 1.106.2 and rotate secrets.
2
Malicious LiteLLM v1.107.0 on PyPI and Docker stole credentials
The build stayed up for under two hours on PyPI; anyone who installed it is told to rotate credentials, not only upgrade.
3
LiteLLM release pipeline hacked to distribute credential-stealing malware
Malicious version 1.107.0 stayed on PyPI for about two hours on October 21 before removal.
1
Malicious LiteLLM 1.107.0 published after suspected token leak
Unpinned installs for a few hours on October 21 pulled a credential stealer and an hourly remote-code backdoor.
3
LiteLLM supply-chain attack reported on PyPI and Docker
The supplied page text does not describe the malicious packages, payloads, or who was affected.
LiteLLM 1.107.0 release carried credential-stealing malware
Malicious Python startup hooks can collect cloud and AI credentials even when applications never import LiteLLM.
Malicious LiteLLM 1.107.0 steals credentials and installs a RAT
PyPI and Docker removed the trojanized release within hours; the latest safe version named is v1.106.2.
Malicious LiteLLM 1.107.0 ships stealer and backdoor
PyPI quarantined the release and Docker images were removed; users should pin 1.106.2 and rotate exposed credentials.
Malicious LiteLLM 1.107.0 on PyPI shipped an infostealer and RAT
All seven wheels and several Docker tags were tainted; PyPI removed the release, and Wiz calls 1.106.2 the latest safe build.
Compromised LiteLLM 1.107.0 on PyPI installs a stealer and backdoor
All seven wheels run the implants in every Python process; PyPI removed the release, and 1.106.2 plus two release candidates are clean.
Trojanized LiteLLM 1.107.0 on PyPI steals credentials
PyPI quarantined the upload within about two hours; matching Docker tags included latest, main-latest and main-stable.
Malicious LiteLLM 1.107.0 published with a credential stealer
PyPI and official Docker tags carried the release for about two hours; the RAT dead-drop never delivered a live second stage.
2
Paper: building from source stops most npm and PyPI malware
A source check blocked 87.7 to 99.9 percent of 47,066 malicious packages, depending on how strictly the source was vetted.
GhostAction workflows in 790 GitHub repos hunt cloud and AI keys
OpenSourceMalware's count through October 9 is validated public repos, not proof that every one leaked secrets.
3