https://pwn.watch/t/pypi Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 14:00:44 GMT https://pwn.watch/i/litellm-1-107-0-pypi-compromise https://pwn.watch/i/litellm-1-107-0-pypi-compromise Thu, 22 Oct 2026 14:00:44 GMT critical <p>On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm. (<a href="https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html">source</a>)</li><li>2026-10-22: StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything. (<a href="https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer">source</a>)</li><li>2026-10-21T11:39Z: Malicious 1.107.0 wheels appear on PyPI.</li></ul> <p><strong>CVEs:</strong> MAL-2026-2144</p> https://pwn.watch/i/ultralytics-pypi-supply-chain-attack https://pwn.watch/i/ultralytics-pypi-supply-chain-attack Wed, 11 Dec 2024 00:00:00 GMT high <p>Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Malicious versions removed from PyPI; see vendor advisory for the clean release</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-11: PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed (<a href="https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/">source</a>)</li><li>2024-12-05: Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner (<a href="https://github.com/ultralytics/ultralytics/issues/18027">source</a>)</li></ul> https://pwn.watch/i/pypi-pauses-registrations-malware-flood-2023 https://pwn.watch/i/pypi-pauses-registrations-malware-flood-2023 Sun, 21 May 2023 00:00:00 GMT medium <p>PyPI temporarily stopped new user registrations and new project names for about a day because malicious users and packages outpaced what its small admin team could handle.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2023-05-21: Registrations resume (<a href="https://www.bleepingcomputer.com/news/security/pypi-temporarily-pauses-new-users-projects-amid-high-volume-of-malware/">source</a>)</li><li>2023-05-20: PyPI suspends new user and new project registration (<a href="https://status.python.org/incidents/0th66lc1l8by">source</a>)</li></ul>