Tag
TeamPCP Compromises PyPi Package durabletask
2 rules 2 TTPs 14 IOCsTeamPCP compromised the PyPi package durabletask (versions 1.4.1, 1.4.2, and 1.4.3), stealing credentials for AWS, Azure, GCP, K8s, and Vault, brute-forcing passwords from password managers, and exfiltrating shell history before propagating to up to 5 targets via AWS SSM and Kubernetes.
Malicious guardrails-ai 0.10.1 Package Published to PyPI
2 rules 1 TTPA malicious version of the guardrails-ai package (0.10.1) was published to PyPI on May 11, 2026, advising users who installed this version to downgrade and treat the host as potentially compromised, rotating credentials and auditing GitHub accounts, with Snowglobe and Guardrails Hub API keys being invalidated on May 13, 2026.
OpenAI Compromised via TanStack Supply Chain Attack
2 rules 1 TTPOpenAI was impacted by the TanStack supply chain attack, resulting in two employee devices being compromised and the exfiltration of credential material from internal source code repositories.
Compromised OpenSearch Pre-Release npm Packages in Supply Chain Attack
2 rules 1 TTPMultiple npm and PyPi packages, including OpenSearch pre-release packages, were compromised in a supply chain attack, potentially leading to arbitrary code execution on developer or user systems.
Shai-Hulud Malware Used in Supply Chain Attack via Compromised npm Packages
3 rules 7 TTPs 3 IOCsThe Shai-Hulud malware was used in a large-scale software supply-chain attack compromising hundreds of packages across open-source software ecosystems by compromising developer secrets and CI/CD pipelines.
Compromise of PyTorch Lightning PyPI Package Versions
2 rules 1 TTP 1 IOCCompromised PyTorch Lightning PyPI packages versions 2.6.2 and 2.6.3 contain malicious code related to credential harvesting, requiring immediate credential rotation and system rebuilding.
Supply Chain Compromises via Npm, PyPI Packages and Teams Phishing Campaigns
3 rules 3 TTPsThe April 2026 Red Canary Intelligence Insights highlights the axios npm compromise, TeamPCP's LiteLLM compromise via PyPI, and a surge in Microsoft Teams phishing, leading to RAT deployment, credential harvesting, ransomware deployment, or data theft.
Compromised Telnyx PyPI Package Distributes Credential-Stealing Malware
2 rules 7 TTPs 7 IOCsA threat actor compromised the PyPI package `telnyx`, uploading malicious versions 4.87.1 and 4.87.2 containing credential-stealing malware that exfiltrates data to a C2 server.
TeamPCP Backdoors Telnyx PyPI Package with Steganographic Malware
2 rules 5 TTPsThe TeamPCP threat actor compromised the Telnyx PyPI package, injecting credential-stealing malware hidden within WAV audio files to target Linux, macOS, and Windows systems.
Compromised Litellm PyPI Package Versions
2 rules 4 TTPs 1 IOCVersions 1.82.7 and 1.82.8 of the Litellm package on PyPI were compromised in a supply chain attack, potentially impacting numerous users, with recommendations to avoid updating to these versions.