PyPI adds a security tab and provenance warnings to help developers verify where Python package files came from before ...

PyPI — the Python Package Index — is the official repository of software for the Python programming language. It helps you find and install software developed and shared by the Python community, and ...

Pinned MCP servers silently pulled new dependencies in Corelight’s tests, an MCP server supply chain risk for admins who hold ...

Malicious MCP servers can self-modify and steal API keys, administrator credentials, and sensitive data from AI coding assistants.

Compromised LiteLLM 1.107.0 packages run a credential stealer at Python startup and can fetch and execute additional code.

LiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed wheel files.

On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to the Python Package Index (PyPI) and distributed through official container images. The malicious package added files that ...

Security researchers have detected a malicious workflow affecting tens of thousands of GitHub repositories, including ...

A new Python package called PoolParty streamlines the design of DNA sequence libraries for high-throughput biological ...

Attackers compromised LiteLLM's release pipeline to ship a credential stealer and backdoor, then tested stolen AWS credentials.

Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.

On October 23, LiteLLM, widely used as an AI Gateway (an OSS that handles numerous LLMs through a single interface), published a minute-by-minute account of the full path of the release compromise on ...