14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-22): Critical Worms, Credential Harvesting, and RCEs

This report highlights 14 supply-chain threats affecting npm, PyPI, and AI-related packages as of May 22, 2026, involving critical worms, credential harvesting, and remote code execution (RCE) vulnerabilities. The information originates from a Reddit cybersecurity post with minimal technical details and no specific affected versions or patches provided. No known exploits in the wild are reported at this time. The severity is assessed as critical based on the nature of the threats mentioned, but detailed technical or remediation information is lacking.

• reddit.com/r/cybersecurity/comments/1tkfk0l/14_npmpypiai_supplychain_threats_today_20260522/ (opens in a new tab)

• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool2026-10-28