LiteLLM version 1.107.0 was compromised and distributed via PyPI and official container images on October 21, 2026. The malicious package used Python startup hooks to automatically execute credential-stealing payloads without requiring explicit import of LiteLLM. Attackers stole developer GitHub credentials to redirect release workflows to a fake repository. The payload targeted authentication credentials across developer tools, AI applications, cloud environments, browsers, and infrastructure. Credentials were encrypted and exfiltrated to attacker-controlled servers. The compromise affected developer workstations, CI/CD agents, test systems, containers, and LiteLLM gateway deployments where Python was executed.
The LiteLLM 1.107.0 Python package was compromised and published to PyPI, distributing malicious code that executed automatically during Python interpreter startup. The payload collected a wide range of credentials including developer, cloud, browser, SSH, and environment variables, then encrypted and exfiltrated this data to attacker-controlled endpoints. The compromise originated from stolen developer GitHub credentials used to alter the release workflow. The malicious code executed without requiring explicit import of LiteLLM, affecting any environment where Python was started with the compromised package installed. Recovery requires more than removing the package; affected Python environments, running processes, and exposed credentials must be addressed. Microsoft Defender provides detection and hunting guidance. No patch or fixed version is explicitly stated.
Aokigahara is an infostealer malware targeting traditional data sources such as browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. It uniquely targets AI applications and development tools, stealing authentication files, session data, and configuration files from services like Claude, ChatGPT Desktop, Codex, and GitHub Copilot. It also collects developer credentials including Git files, SSH private keys, and cloud service credentials (AWS, Azure, Google Cloud). The stolen AI credentials may be used for unauthorized access, account resale, or data extortion. The malware uses anti-analysis techniques and secures its command-and-control communications with AES-256 encryption and X25519 key exchange.
CVE-2026-53942 is a critical code injection vulnerability in the Conda Organization Infrastructure. It involves a GitHub Actions workflow triggered by issue comments that can lead to rendering attacker-controlled templates using an unsandboxed Jinja2 environment. This allows untrusted pull request or comment content to execute code in a privileged token context. The vulnerability has been patched in commit 9c0f238.
Aokigahara is a newly observed infostealer malware that targets a wide range of sensitive data on Windows systems. It steals traditional credentials such as browser passwords, cookies, cryptocurrency wallets, VPN and FTP client data, email profiles, and password manager files. Uniquely, it also targets AI applications and developer tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, collecting authentication files, session tokens, and configuration data. The malware additionally targets cloud environment credentials for AWS, Azure, and Google Cloud, as well as developer environment secrets like Git credentials and SSH private keys. Stolen AI and cloud credentials could enable unauthorized access to paid AI services, cloud resources, and source code repositories. The malware includes capabilities such as screenshot capture, clipboard theft, and a clipper component for cryptocurrency manipulation. There is no confirmed information on how the stolen data is monetized. No patch or remediation guidance is provided.
CVE-2026-55422 is a cross-site scripting (XSS) vulnerability in the conda-forge.github.io website, which is part of the conda-forge GitHub organization. The issue arises because two React components render externally sourced strings directly as HTML using dangerouslySetInnerHTML without sanitization. These strings include raw output from build logs and other process outputs embedded in JSON files generated by the conda-forge autotick bot. At the time of disclosure, no patches are publicly available.
LiteLLM version 1.107.0 was compromised in a supply chain attack where attackers used leaked GitHub CLI OAuth tokens to push malicious packages to PyPI and Docker. The malicious packages were available for about three hours and downloaded over 49,000 times. The malware included an information stealer and a remote access trojan (RAT) that harvested sensitive credentials and secrets, then communicated with attacker-controlled servers. The incident was traced to leaked tokens exposed via logs and involved disabling branch protections and redirecting release workflows. Enterprise customers using private repositories were not affected. Users are advised to remove the compromised version and rotate credentials.
ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime".
Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute the contents of the archive, since no integrity check was performed on the download.
Successful exploitation requires compromising "download.checkmarx.com" and replacing the served archive with one containing an attacker-controlled binary. If the served archive had been replaced that way, any developer machine or CI pipeline invoking ASCA (via Checkmarx's VSCode/JetBrains extensions) or cx scan "sca-realtime" on an affected version would have extracted and executed that binary in place of the intended download.
The download is now verified against a published SHA-256 checksum before extraction.
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.
Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.
Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.
CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. A pull_request_target workflow checks out fork code using github.event.pull_request.head.sha or .head.ref. This gives attacker-controlled code access to base repository secrets and tokens. A pull_request_target workflow writes to a shared Actions cache. A subsequent release or publish workflow restores from the same cache scope, allowing a poisoned cache entry to execute during release. This issue has been patched via commit 271d415.
This analysis covers rapid credential theft and data exfiltration attacks that occur within minutes of initial compromise, often outpacing traditional security detection and response. Attackers exploit stolen GitHub tokens, malicious AI tool installers, and MFA phishing to quickly access and exfiltrate sensitive data. Detection requires anomaly and behavior-based monitoring, while effective containment demands automated or autonomous response to minimize attacker dwell time. Manual response delays enable significant data loss. The threat highlights gaps in current identity provider detections and the need for integrated, fast-acting defense mechanisms.
The npm package 'formatting-subtitles' version 1.0.2 contains malicious code in its preinstall script. The script masquerades as JavaScript but is executed by the shell, which runs attacker-controlled commands. During installation, it fetches and executes arbitrary code from a mutable GitHub Gist and sends installation metadata to an attacker-controlled webhook. This behavior allows remote code execution and data leakage during npm install.
On October 21, 2026, the LiteLLM Python proxy library version 1.107.0 was compromised in a supply chain attack. The malicious release was available on PyPI and official Docker images for approximately two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to deploy a malicious fork via a private release workflow. The payload included a credential stealer targeting cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, as well as a second-stage remote access trojan backdoor. The malware executes automatically whenever Python starts by placing files in the site-packages directory. This is the second known supply chain compromise of LiteLLM in 2026, unrelated to the previous incident linked to TeamPCP activity.
LiteLLM version 1.107.0 was compromised in a supply chain attack affecting PyPI packages and Docker images. The malicious release includes Python startup files that execute automatically, stealing cloud credentials, private keys, browser data, and AI development tool authentication tokens. The attack used a lookalike repository in the release workflow and targets credentials for AWS, Azure, Google Cloud, GitHub CLI, SSH keys, npm/PyPI, and AI tools such as Claude, Gemini, and Cursor. Stolen data is encrypted and sent to a command-and-control server. A loader enables remote Python code execution. The package has approximately 23 million weekly downloads, indicating a significant potential impact.
The npm package data-pipeline-testmetest version 2.0.1 contains malicious code that executes during installation without a declared install script. It uses a binding.gyp file to run an obfuscated loader that decrypts and executes a large payload. This payload steals credentials from GitHub, npm, PyPI, RubyGems, and cloud services, then commits them to a public GitHub repository created in the victim's account. It also republishes the victim's packages with the same malicious hook. If a GitHub token is found, it installs a destructive service that deletes the user's home directory once the token is revoked. Removal of this service before token revocation and credential rotation is necessary to prevent data loss.
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message.
Root Cause:
When processing an RTMP Abort (protocol control message type 2), the RTMP policy implementation deleted the target RtmpChunkStream object. The send path (RtmpUnsentMessage::AppendAndDestroySelf -> RtmpChunkStream::SerializeMessage) runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is concurrently being used to serialize an outgoing message, the stream object is freed while still in use, resulting in a use-after-free. Additionally, deleting the chunk stream discarded its previous message header, so subsequent compressed (type-3) chunk headers on that stream could no longer be decoded.
Affected Scenarios:
Any application using the bRPC RTMP protocol implementation (rtmp policy), either as an RTMP server or as an RTMP client, where the remote endpoint is untrusted. The attacker needs to send an Abort message targeting a chunk stream id that is concurrently used for sending, which can crash the process or lead to memory corruption.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3515
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.
Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.
Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499
Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.
Root Cause:
The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.
Affected Scenarios:
Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.
How to Fix:
(Choose one of the following options)
1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3325
Note:
The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
Operation FlashHole is a sophisticated cyberattack campaign launched by the Lazarus Group targeting South Korea. It exploits mandatory security software CrossWeb EX using watering hole attacks and spear-phishing with fake portfolio and resume websites. The campaign, active since July prior to January, targets sectors including software, construction, and cable equipment manufacturing. It employs a modular malware framework combining multiple malware families such as TechHub, Cubridge, TouchShift, TouchHub, ClientHub, and LPEClient. Techniques used include in-memory execution, DLL side-loading, and command-and-control infrastructure leveraging GitHub and Dropbox. The attackers also incorporate advanced cryptographic methods like post-quantum cryptography (ML-KEM-1024) and GOST encryption. This campaign demonstrates Lazarus Group's evolving tactics specifically tailored for South Korean targets.
In October 2026, OVHcloud's official CLI tool was compromised through a hijacked developer GitHub account. Versions v0.11.0 through v0.15.0 of the CLI contained a malicious binary designed to steal secrets from users' disks. The compromise lasted approximately 94 minutes before being detected and blocked. The attacker replaced binaries on GitHub releases without CI/CD pipeline involvement due to disabled release immutability. The developer account had been compromised since at least March 2026, with evidence of a GlassWorm-linked loader in personal repositories. Users who installed or updated the CLI during the incident window on common platforms are affected, while those who built from source or used other installation methods are not.