← Home
#pypi
33 stories tagged.
The Worm That Learned to Sign Itself: Shai Hulud's Eight-Month npm Supply Chain Rampage — A Full Post-Mortem
12 min · 0 sources
The CI/CD Takeover: How GitHub Actions Script Injection Turned elementary-data Into a 1.1M-Download Infostealer
9 min · 0 sources
QLNX: The Developer-Hunting Linux RAT That Turns Package Maintainers into Supply Chain Weapons
10 min · 0 sources
The Worm That Eats Developers: Shai-Hulud's Third Coming and the Mini Wave That Hit 1,800 Repos in 48 Hours
10 min · 0 sources
The Developer Is the New Perimeter: How QLNX and Shai-Hulud Are Turning Developer Workstations Into Supply Chain Launchpads
11 min · 0 sources
The Worm That Reads Your Secrets: Shai-Hulud, QLNX, and the 2026 Developer Credential Supply Chain War
9 min · 0 sources
The Worm That Crossed the Ecosystem: Mini Shai-Hulud's PyTorch Lightning Hijack and the Rise of Cross-Registry Supply Chain Attacks
10 min · 0 sources
The 11-Hour Data Heist: How a GitHub Actions PR Comment Poisoned 1.1M-Download PyPI Package elementary-data
9 min · 0 sources
The 42-Minute Worm: TeamPCP's Mini Shai-Hulud Tears Through PyTorch, SAP, and Intercom in 48 Hours
9 min · 0 sources
The Developer Machine as Rental Infrastructure: How kube-health-tools Turned Kubernetes Engineers Into Chinese LLM Relay Nodes
8 min · 0 sources
The Data Pipeline That Became a Drain: How elementary-data's CI/CD Was Weaponized to Steal 1.1M-Download-Scale Cloud Credentials
9 min · 0 sources
Locking Down the AI Stack: A 2026 Defender's Playbook for LLM Infrastructure
11 min · 0 sources
The Worm That Won't Stop: TeamPCP's Mini Shai-Hulud Supply Chain Campaign Devours SAP, Bitwarden, and PyTorch Lightning
9 min · 0 sources
The Comment That Poisoned a Million Pipelines: elementary-data's GitHub Actions Script Injection and the Rise of CI-Native Supply Chain Attacks
10 min · 0 sources
Shai-Hulud Devours the Ecosystem: TeamPCP's Cross-Ecosystem Supply Chain Blitz Hits PyTorch Lightning, SAP npm, Bitwarden, and Hundreds of CI/CD Pipelines
8 min · 0 sources
The Pipeline Is the Payload: How GitHub Actions Script Injection Turned elementary-data Into a Credential Harvester for 1.1 Million Developers
11 min · 0 sources
The Worm That Rode the Sandstorm: Mini Shai-Hulud's TeamPCP Supply Chain Assault Across PyPI, npm, and PHP
10 min · 0 sources
The Pipeline Is the Weapon: How elementary-data's GitHub Actions Injection Turned 1.1 Million PyPI Installs Into a Credential Vacuum
11 min · 0 sources
The Worm That Reads the Room: TeamPCP's Mini Shai-Hulud Crosses the PyPI/npm Divide and Poisons AI Infrastructure
10 min · 0 sources
The AI Framework Trojan: How PyTorch Lightning's PyPI Compromise Became the Most Dangerous Supply Chain Attack of 2026
11 min · 0 sources
The AI Agent Toolchain Is the New Kill Zone: CanisterSprawl's Post-Mortem
11 min · 0 sources
The Worm That Codes Itself: TeamPCP's Mini Shai-Hulud and the Industrialization of Open-Source Supply Chain Attacks
11 min · 0 sources
The Worm That Crossed the Ocean: Mini Shai-Hulud, TeamPCP, and the Supply Chain Attack That Won't Stop Evolving
11 min · 0 sources
The Password Manager Was the Payload: Shai-Hulud v3, the Triple-Registry Storm, and the Collapse of Developer Trust
11 min · 0 sources
The Guardians Were Already Compromised: TeamPCP's Second Checkmarx Strike and the April 2026 Triple-Registry Credential Harvest
9 min · 0 sources
The Fortune 500 Faker: How Attackers Impersonated Asurion's npm Packages to Run a Multi-Stage Credential Harvester
11 min · 0 sources
The Worm That Lives on the Blockchain: CanisterSprawl's ICP C2 Architecture and the 48-Hour Supply Chain Blitz That Broke Three Ecosystems
10 min · 0 sources
The 48-Hour Supply Chain Siege: Shai-Hulud, TeamPCP, and the Week the Developer Toolchain Became the Kill Chain
11 min · 0 sources
CanisterSprawl Post-Mortem: How npm's Self-Propagating Worm Weaponized Blockchain Infrastructure to Become Seizure-Proof
11 min · 0 sources
The 48-Hour Siege: How Three Simultaneous Supply Chain Campaigns Turned npm, PyPI, and Docker Hub Into Credential Factories
12 min · 0 sources
The Scanner That Scanned You Back: TeamPCP's Second Checkmarx Breach and the April 2026 Supply Chain Siege
13 min · 0 sources
Your Kubernetes Package Is Now an AI Piracy Node: The kube-health-tools GPT-Proxy Supply Chain Attack
9 min · 0 sources
The April 2026 Open Source Supply Chain Storm: Axios, CanisterWorm, and the 48-Hour Assault on npm, PyPI, and Docker Hub
10 min · 0 sources