整理 | 郑丽媛出品 | CSDN（ID：CSDNnews）如果你是一名 Python 开发者，对 pip install 命令肯定很熟悉——这是最常用的套件安装指令，可用来从 PyPI 或其它来源安装、升级与管理套件。但就在 3 月 24 ...

Malicious telnyx 4.87.1/4.87.2 on PyPI used audio steganography March 27, 2026, enabling cross-platform credential theft.

The compromised packages, linked to the Trivy breach, executed a three‑stage payload targeting AWS, GCP, Azure, Kubernetes ...

Socket and Endor Labs discovered a new TeamPCP campaign leading to the delivery of credential-stealing malware ...

The TeamPCP hacking group continues its supply-chain rampage, now compromising the massively popular "LiteLLM" Python package ...

After hacking Trivy, TeamPCP moved to compromise repositories across NPM, Docker Hub, VS Code, and PyPI, stealing over 300GB ...

慢雾首席信息安全官 23pds 发推表示，月下载量高达 9700 万次的 Python AI 网关库 LiteLLM 遭遇 PyPI 供应链攻击，攻击者通过 pip install litellm 指令即可在用户设备上窃取敏感信息。可窃取的敏感数据包括：SSH 密钥、云服务凭据（AWS / GCP / Azure）、Kubernetes 配置文件、Git 凭据、环境变量中的 API 密钥、Shel ...

A widely used Python package with more than 95 million monthly downloads has been compromised with credential-stealing ...

A cyber attack hit LiteLLM, an open-source library used in many AI systems, carrying malicious code that stole credentials ...

Supply chain attacks feel like they're becoming more and more common.

Andrej Karpathy, the former Tesla AI director and OpenAI cofounder, is calling a recent Python package attack \"software ...

编辑｜冷猫这是一件极其严肃的软件安全事件。今天，Karpathy 发长推文警告全部开发者注意，GitHub 超过 4 万星，月下载量达 9700 万次的 Python 库 LiteLLM 在 PyPI 上被投毒。首先提请各位开发者检查自己的 ...