{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/pypi/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["pytorch-lightning"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","pypi","credential-theft","malware"],"_cs_type":"advisory","_cs_vendors":["GitHub"],"content_html":"\u003cp\u003eOn April 30, 2026, two malicious versions (2.6.2 and 2.6.3) of the widely used \u003ccode\u003epytorch-lightning\u003c/code\u003e package were published to the PyPI registry after the publisher account was compromised. These versions contain embedded malicious code designed to steal developer credentials and republish infected versions of repositories to which the stolen tokens have access. The attack is triggered upon importing the package, initiating a background process that silently harvests credentials from a wide array of services, including AWS, Azure, Google Cloud, and GitHub, as well as local environment variables and credential files. Version 2.6.3 was published just 13 minutes after 2.6.2, and was intended to evade detection.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker compromises the publisher account for the \u003ccode\u003epytorch-lightning\u003c/code\u003e package on PyPI.\u003c/li\u003e\n\u003cli\u003eAttacker publishes malicious versions 2.6.2 and 2.6.3 to PyPI.\u003c/li\u003e\n\u003cli\u003eA modified \u003ccode\u003e__init__.py\u003c/code\u003e file within the package initiates a background process upon import.\u003c/li\u003e\n\u003cli\u003eThe background process executes silently, without any visible output or indication of compromise to the user.\u003c/li\u003e\n\u003cli\u003eThe malicious package downloads a runtime (Bun) from GitHub.\u003c/li\u003e\n\u003cli\u003eThe package executes a large, obfuscated JavaScript file, targeting AWS, Azure, Google Cloud, GitHub, and local credential stores.\u003c/li\u003e\n\u003cli\u003eStolen credentials, including cloud provider keys, API tokens, and secrets, are exfiltrated to attacker-controlled infrastructure.\u003c/li\u003e\n\u003cli\u003eThe malware attempts to download and execute a second-stage payload from attacker-controlled infrastructure, expanding the scope of the attack.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eOrganizations that downloaded and used versions 2.6.2 or 2.6.3 of the \u003ccode\u003epytorch-lightning\u003c/code\u003e package are at high risk of compromise. The malicious package is designed to steal a wide range of credentials, including cloud provider keys, API tokens, and secrets stored in environment variables. This can lead to unauthorized access to sensitive data and systems, potentially resulting in data breaches, financial losses, and reputational damage. The malware\u0026rsquo;s ability to download and execute secondary payloads further increases the potential impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately remove versions 2.6.2 and 2.6.3 of the \u003ccode\u003elightning\u003c/code\u003e package from all systems where they are installed (see overview).\u003c/li\u003e\n\u003cli\u003eAudit systems for unauthorized processes and review outbound network connections to detect potential compromises (see overview).\u003c/li\u003e\n\u003cli\u003eRotate all cloud provider keys (AWS, Azure, GCP), API tokens (GitHub, CI/CD systems), and secrets stored in environment variables to prevent further unauthorized access (see Attack Chain).\u003c/li\u003e\n\u003cli\u003eImplement the \u003ccode\u003eDetect Suspicious PyPI Package Installation\u003c/code\u003e Sigma rule to identify potential malicious packages being installed in the future (see rules).\u003c/li\u003e\n\u003cli\u003eImplement the \u003ccode\u003eDetect Credential Harvesting via Bun\u003c/code\u003e Sigma rule to catch execution of the malicious JavaScript payload (see rules).\u003c/li\u003e\n\u003cli\u003ePin dependencies to known-good versions and verify package integrity before use to prevent future supply chain attacks (see references).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-01T00:45:31Z","date_published":"2026-05-01T00:45:31Z","id":"/briefs/2026-05-pytorch-lightning-compromise/","summary":"Compromised PyTorch Lightning packages versions 2.6.2 and 2.6.3 on PyPI contain malicious code to steal developer credentials from cloud and developer environments, and republish infected packages.","title":"Compromised PyTorch Lightning Packages on PyPI Steal Developer Credentials","url":"https://feed.craftedsignal.io/briefs/2026-05-pytorch-lightning-compromise/"},{"_cs_actors":["TeamPCP"],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["supply-chain","pypi","credential-theft","teampcp"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eOn March 27, 2026, the \u003ccode\u003etelnyx\u003c/code\u003e Python package on PyPI was compromised by TeamPCP, resulting in the distribution of malicious versions 4.87.1 and 4.87.2. The attacker, having gained unauthorized access to PyPI credentials, bypassed the legitimate GitHub release pipeline to upload these compromised packages directly. These versions contain malware designed to harvest sensitive credentials from infected systems and exfiltrate them to a command-and-control (C2) server. The malicious packages were available for approximately 6 hours before being quarantined by PyPI. Version 4.87.1 contained a typo preventing execution, making 4.87.2 the fully functional malicious version. This incident highlights the risk of supply chain attacks targeting open-source package repositories, potentially affecting any system that installed the \u003ccode\u003etelnyx\u003c/code\u003e package during the exposure window.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains unauthorized access to PyPI credentials for the \u003ccode\u003etelnyx\u003c/code\u003e package.\u003c/li\u003e\n\u003cli\u003eThe attacker uploads malicious versions 4.87.1 and 4.87.2 of the \u003ccode\u003etelnyx\u003c/code\u003e package to PyPI, bypassing the legitimate GitHub repository.\u003c/li\u003e\n\u003cli\u003eWhen a user installs or upgrades to the malicious \u003ccode\u003etelnyx\u003c/code\u003e package, the injected malware within \u003ccode\u003etelnyx/_client.py\u003c/code\u003e executes upon importing the library (\u003ccode\u003eimport telnyx\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eOn Linux/macOS systems, the malware spawns a detached subprocess to ensure persistence and downloads a payload hidden inside a WAV audio file (\u003ccode\u003eringtone.wav\u003c/code\u003e) from the C2 server at \u003ccode\u003ehttp://83.142.209.203:8080/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe downloaded payload harvests sensitive credentials, including SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configurations, .env files, database credentials, and crypto wallets.\u003c/li\u003e\n\u003cli\u003eIf Kubernetes access is detected, the malware deploys privileged pods to all nodes for lateral movement within the Kubernetes cluster.\u003c/li\u003e\n\u003cli\u003eThe collected data is encrypted using AES-256-CBC and RSA-4096, then exfiltrated to the C2 server, identified by the header \u003ccode\u003eX-Filename: tpcp.tar.gz\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn Windows, a binary payload hidden in \u003ccode\u003ehangup.wav\u003c/code\u003e is downloaded from \u003ccode\u003ehttp://83.142.209.203:8080/\u003c/code\u003e, dropped as \u003ccode\u003emsbuild.exe\u003c/code\u003e in the Startup folder for persistence, and executed with a hidden window, polling the endpoint \u003ccode\u003ehttp://83.142.209.203:8080/raw\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe compromise of the \u003ccode\u003etelnyx\u003c/code\u003e PyPI package poses a significant risk to developers and organizations that use the library.  Successful exploitation leads to the theft of sensitive credentials, potentially granting the attacker unauthorized access to critical infrastructure, cloud resources, and sensitive data. TeamPCP\u0026rsquo;s previous campaign against LiteLLM and the similarities in this attack suggest a pattern of targeting open-source projects to infiltrate developer environments and steal secrets.  The impact includes potential data breaches, financial losses, and reputational damage. The exposure window was approximately 6 hours during which vulnerable versions were available.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately check for the presence of malicious \u003ccode\u003etelnyx\u003c/code\u003e package versions (4.87.1 or 4.87.2) in your environment using the provided commands and uninstall them (\u003ccode\u003epip uninstall telnyx\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDue to the credential-stealing nature of the malware, rotate all potentially exposed secrets, including SSH keys, cloud provider credentials (AWS, GCP, Azure), Kubernetes tokens, Docker registry credentials, database passwords, API keys in .env files, and Telnyx API keys.\u003c/li\u003e\n\u003cli\u003eCheck for persistence mechanisms used by the malware, specifically the \u003ccode\u003eaudiomon\u003c/code\u003e service and associated files on Linux/macOS, and the \u003ccode\u003emsbuild.exe\u003c/code\u003e executable in the Startup folder on Windows, based on the file paths provided in the \u0026ldquo;Filesystem\u0026rdquo; section.\u003c/li\u003e\n\u003cli\u003eBlock the identified C2 IP address (\u003ccode\u003e83.142.209.203\u003c/code\u003e) and payload URLs (\u003ccode\u003ehttp://83.142.209.203:8080/ringtone.wav\u003c/code\u003e, \u003ccode\u003ehttp://83.142.209.203:8080/hangup.wav\u003c/code\u003e, \u003ccode\u003ehttp://83.142.209.203:8080/raw\u003c/code\u003e) at your network perimeter.\u003c/li\u003e\n\u003cli\u003eDeploy the following Sigma rule to detect the creation of \u003ccode\u003emsbuild.exe\u003c/code\u003e in the Startup folder.\u003c/li\u003e\n\u003cli\u003ePin the \u003ccode\u003etelnyx\u003c/code\u003e package to the safe version 4.87.0 in your project dependencies to prevent future installations of compromised versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-30T19:15:30Z","date_published":"2026-03-30T19:15:30Z","id":"/briefs/2026-03-telnyx-pypi-compromise/","summary":"A threat actor compromised the PyPI package `telnyx`, uploading malicious versions 4.87.1 and 4.87.2 containing credential-stealing malware that exfiltrates data to a C2 server.","title":"Compromised Telnyx PyPI Package Distributes Credential-Stealing Malware","url":"https://feed.craftedsignal.io/briefs/2026-03-telnyx-pypi-compromise/"},{"_cs_actors":["TeamPCP"],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["supply chain attack","pypi","credential theft","steganography"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eOn March 27, 2026, the Telnyx package on the Python Package Index (PyPI) was compromised by the threat actor TeamPCP. Malicious versions 4.87.1 and 4.87.2 were uploaded, containing credential-stealing malware concealed within WAV audio files. This supply-chain attack targeted developers using the Telnyx Python SDK, a popular package with over 740,000 monthly downloads, used for integrating communication services into applications. The malicious code resides in the \u003ccode\u003etelnyx/_client.py\u003c/code\u003e file and executes upon import. The compromise is believed to have originated from stolen credentials for the publishing account on the PyPI registry. TeamPCP has been linked to previous supply-chain attacks and wiper campaigns against Iranian systems, highlighting the group\u0026rsquo;s focus on disrupting software development and infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eTeamPCP gains unauthorized access to the Telnyx PyPI account, likely through credential theft.\u003c/li\u003e\n\u003cli\u003eMalicious versions 4.87.1 and 4.87.2 of the Telnyx package are published to PyPI.\u003c/li\u003e\n\u003cli\u003eWhen a developer installs the compromised Telnyx package, the \u003ccode\u003etelnyx/_client.py\u003c/code\u003e file is executed upon import.\u003c/li\u003e\n\u003cli\u003eOn Linux and macOS, a detached process is spawned to download a second-stage payload disguised as a WAV audio file (\u003ccode\u003eringtone.wav\u003c/code\u003e) from a remote command-and-control (C2) server.\u003c/li\u003e\n\u003cli\u003eSteganography is used to hide malicious code within the WAV file\u0026rsquo;s data frames.\u003c/li\u003e\n\u003cli\u003eThe embedded payload is extracted using an XOR-based decryption routine and executed in memory.\u003c/li\u003e\n\u003cli\u003eThe malware harvests sensitive data, including SSH keys, credentials, cloud tokens, cryptocurrency wallets, and environment variables.\u003c/li\u003e\n\u003cli\u003eIf Kubernetes is present, the malware enumerates cluster secrets and deploys privileged pods to access underlying host systems. On Windows, a different WAV file (\u003ccode\u003ehangup.wav\u003c/code\u003e) is downloaded that extracts and saves an executable named \u003ccode\u003emsbuild.exe\u003c/code\u003e to the startup folder for persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis supply chain attack could result in widespread compromise of systems utilizing the Telnyx Python SDK. Over 740,000 monthly downloads indicate a large potential victim pool. Stolen credentials and secrets can lead to unauthorized access to cloud resources, sensitive data exfiltration, and further lateral movement within compromised networks. For systems running Kubernetes, the attacker could gain control over the entire cluster, leading to significant disruption and data loss. Developers who installed the malicious packages are advised to consider their systems fully compromised and rotate all secrets as soon as possible.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and remove Telnyx versions 4.87.1 and 4.87.2 from all environments, reverting to version 4.87.0 as recommended by the vendor.\u003c/li\u003e\n\u003cli\u003eMonitor network connections for processes spawned by Python interpreters (\u003ccode\u003epython.exe\u003c/code\u003e, \u003ccode\u003epython3\u003c/code\u003e) attempting to download files with the \u003ccode\u003e.wav\u003c/code\u003e extension, using the \u0026ldquo;Detect Suspicious Python WAV Download\u0026rdquo; Sigma rule provided below.\u003c/li\u003e\n\u003cli\u003eImplement stricter controls and multi-factor authentication for PyPI accounts used to publish packages to prevent similar supply chain attacks.\u003c/li\u003e\n\u003cli\u003eDeploy the \u0026ldquo;Detect msbuild.exe in Startup Folder\u0026rdquo; Sigma rule to identify potential persistence attempts on Windows systems.\u003c/li\u003e\n\u003cli\u003eRotate all secrets and credentials on any system that has imported the malicious Telnyx package.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-28T12:00:00Z","date_published":"2026-03-28T12:00:00Z","id":"/briefs/2026-03-teampcp-telnyx/","summary":"The TeamPCP threat actor compromised the Telnyx PyPI package, injecting credential-stealing malware hidden within WAV audio files to target Linux, macOS, and Windows systems.","title":"TeamPCP Backdoors Telnyx PyPI Package with Steganographic Malware","url":"https://feed.craftedsignal.io/briefs/2026-03-teampcp-telnyx/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["supply-chain","pypi","litellm","compromise"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOn March 24, 2026, versions 1.82.7 and 1.82.8 of the Litellm package, available on the Python Package Index (PyPI), were reported as compromised. This supply chain attack potentially affects thousands of users who may have updated to the malicious versions. The compromised packages could contain malicious code injected by an unknown threat actor. Users are advised to avoid updating to these versions and investigate their systems for potential compromise. The initial report came from a Reddit post and links to a blog post for further details.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003cp\u003eWhile the specifics of the attack chain are not fully detailed in the source, a typical supply chain attack targeting PyPI packages involves the following steps:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003ePackage Compromise:\u003c/strong\u003e Threat actor gains unauthorized access to the Litellm PyPI account or the build environment.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Code Injection:\u003c/strong\u003e The attacker injects malicious code into the setup.py or other relevant files within the Litellm package. This malicious code could be designed to execute upon installation.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVersion Release:\u003c/strong\u003e The compromised versions, 1.82.7 and 1.82.8, are released to PyPI, making them available for users to download and install.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePackage Installation:\u003c/strong\u003e Users unknowingly download and install the compromised Litellm package using pip, triggering the execution of the injected malicious code.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access:\u003c/strong\u003e The malicious code may establish a reverse shell, download additional payloads, or perform other actions to gain initial access to the victim\u0026rsquo;s system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence:\u003c/strong\u003e The attacker may establish persistence on the compromised system through various techniques, such as creating scheduled tasks or modifying startup scripts.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration/Malware Deployment:\u003c/strong\u003e Depending on the attacker\u0026rsquo;s objective, they may exfiltrate sensitive data, deploy ransomware, or perform other malicious activities.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement:\u003c/strong\u003e The attacker may attempt to move laterally to other systems within the compromised network, escalating their access and expanding their reach.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe compromise of Litellm versions 1.82.7 and 1.82.8 could lead to widespread compromise of systems that use the package. The injected malicious code could enable attackers to steal sensitive information, deploy malware, or gain unauthorized access to victim systems. The number of affected users is estimated to be in the thousands. This incident highlights the risks associated with supply chain attacks targeting open-source software repositories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately stop updating to Litellm versions 1.82.7 and 1.82.8.\u003c/li\u003e\n\u003cli\u003eRevert to a known-good version of Litellm prior to 1.82.7.\u003c/li\u003e\n\u003cli\u003eAnalyze network connections for suspicious traffic originating from systems where the compromised Litellm versions were installed, using network connection logs.\u003c/li\u003e\n\u003cli\u003eMonitor process creations for suspicious processes spawned from Python executables where Litellm is installed, using process creation logs and the Sigma rules provided below.\u003c/li\u003e\n\u003cli\u003eInvestigate systems where Litellm 1.82.7 or 1.82.8 were installed for any signs of compromise.\u003c/li\u003e\n\u003cli\u003eReview the blog post at \u003ca href=\"https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/\"\u003ehttps://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/\u003c/a\u003e for further details on the compromise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-24T12:12:58Z","date_published":"2026-03-24T12:12:58Z","id":"/briefs/2024-01-litellm-compromise/","summary":"Versions 1.82.7 and 1.82.8 of the Litellm package on PyPI were compromised in a supply chain attack, potentially impacting numerous users, with recommendations to avoid updating to these versions.","title":"Compromised Litellm PyPI Package Versions","url":"https://feed.craftedsignal.io/briefs/2024-01-litellm-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed — Pypi","version":"https://jsonfeed.org/version/1.1"}