Malicious Packages articles

Three poisoned xinference releases on PyPI target AI infrastructure credentials.

See how the attack works, what to look for, and how to remediate.

See how the attack works, what to look for, and how to remediate.

Check and fix your install for the new LiteLLM PyPI compromise.

Deep dive into the self-spreading CanisterWorm.

Analysis of an npm account flooding the registry with malformed font packages.

See how the latest Shai-Hulud attack works.

A major NPM breach exposed 187 packages.

A sophisticated npm supply chain attack compromised popular packages

Learn about a fake VS-code extension on npm—truffelvscode—typosquatting the popular truffle for VS-code extension.

An Apache Tomcat web server vulnerability has been published, exposing the platform to remote code execution through a race condition failure.

This post covers the attack flow, how it happened, and the importance of supply chain security.

The new Chinese owner tampers with the code of cdn.polyfill.io to inject malware targeting mobile devices.

Discover how CVE-2024-3094 affects XZ Utils and enables SSH compromise. Get insights on detection, mitigation, and system security.

Discover the latest security threat as over 100 malicious packages target popular ML PyPi libraries. Learn about the attack methods.

Learn how to protect your code from malicious packages with these eight considerations. Stay ahead of supply chain security threats.