/
ttps_attack:T1552.001 × criticity:critical × victim_sectors:software_development × limpar

Resultados

3 casos · pág. 1/1

safedep.io · critical

MemTensor npm and PyPI packages backdoored with self-propagating Go worm sckit after GitHub Actions release token theft

On September 23, 2026, an attacker published malicious versions of @memtensor/memos-cloud-openclaw-plugin (npm, versions 0.1.21, 0.1.23 and 0.1.25 per the article) and the MemoryOS Python library (PyPI, 2.0.34). Both carry the same Go implant, sckit, which harvests credentials from the home directory, exfiltrates them to servers under sky…

technology software_development
safedep.io · critical

npm worm poisons 2,234 versions across 444 packages, including keyv and cacheable, stealing cloud and CI credentials

On 4 August 2026, an npm worm published 2,234 poisoned versions across 444 package names, using credentials from twelve organisations. Affected scopes include @ornikar, @deliveroo, @onereach, @or-sdk, @servicetitan, @qlik, @picsart, and the keyv and cacheable families. The keyv, flat-cache, file-entry-cache and cacheable-request packages …

technology software_development
theregister.com · · 5 fontes · 5 atualizações critical

LiteLLM 1.107.0 trojanized on PyPI and Docker images via stolen GitHub tokens: infostealer and RCE backdoor through Python startup hooks

The LiteLLM release 1.107.0 (a widely used open source LLM proxy and AI gateway developed by BerriAI, about 23 million weekly downloads per theregister.com) was trojanized on PyPI on 21 October 2026 and carries a credential stealer (privcollect) plus a remote code execution backdoor. All wheels (Linux, macOS, Windows) drop three extra fil…

technology software