https://vulnpocalypse.dev/feeds/Python package and PyPI supply-chain advisories: hijacked releases, malicious packages and poisoned dependencies.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/https://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/Wed, 11 Nov 2026 12:00:00 +0000Attackers with stolen gh CLI tokens shipped malware as LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR. Check before running Python, then rebuild and rotate.supply-chainpypiai-toolsci-cdhttps://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/Wed, 11 Nov 2026 12:00:00 +0000LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.supply-chainpypiai-toolsopen-sourceci-cdcloudhttps://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/https://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/Wed, 11 Nov 2026 12:00:00 +0000Eight eMudhra intermediate CA keys were guessable. Browsers block them; update CA bundles and runtimes, and replace TLS certs under emSign ECC Root CA - G3.ecosystemendpointnodejspypiopen-sourcehttps://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/https://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/Wed, 11 Nov 2026 12:00:00 +0000Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.supply-chaingithub-actionspypici-cdai-toolshttps://vulnpocalypse.dev/advisories/jfrog-says-new-threat-hub-maps-vulnerability-blast-radius/https://vulnpocalypse.dev/advisories/jfrog-says-new-threat-hub-maps-vulnerability-blast-radius/Tue, 10 Nov 2026 12:00:00 +0000JFrog says its new Threat Hub turns vulnerability intelligence into blast radius analysis; no new flaw is disclosed, so verify claims yourself.ai-toolsai-toolsnpmpypihttps://vulnpocalypse.dev/advisories/litellm-supply-chain-compromise-2026-11/https://vulnpocalypse.dev/advisories/litellm-supply-chain-compromise-2026-11/Wed, 04 Nov 2026 12:00:00 +0000Malicious litellm 1.107.0 on PyPI and Docker ran a credential stealer and RAT at Python startup. Last safe pre-incident release is 1.106.2.supply-chainpypiai-toolsopen-sourcehttps://vulnpocalypse.dev/advisories/langflow-critical-auth-bypass-and-rce-flaws-upgrade-to-1130/https://vulnpocalypse.dev/advisories/langflow-critical-auth-bypass-and-rce-flaws-upgrade-to-1130/Tue, 03 Nov 2026 12:00:00 +0000IBM disclosed four Langflow flaws, two rated critical, affecting versions 1.0.0 through 1.12.8; upgrade Langflow to version 1.13.0.ai-toolsai-toolspypiopen-sourcewebhttps://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/Mon, 02 Nov 2026 12:00:00 +0000October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.ai-toolsphpnodejspypinpmgithub-actionsai-toolscryptocloudhttps://vulnpocalypse.dev/advisories/malware-advisory-flood-october-2026/https://vulnpocalypse.dev/advisories/malware-advisory-flood-october-2026/Mon, 02 Nov 2026 12:00:00 +0000GitHub published 112 malware advisories for 106 npm and PyPI packages from 26 to 28 Oct 2026: miners, stealers, beacons. Grep lockfiles for the named packages.supply-chainnpmpypihttps://vulnpocalypse.dev/advisories/mcp-2026-atlassian-sdk-opencode/https://vulnpocalypse.dev/advisories/mcp-2026-atlassian-sdk-opencode/Mon, 02 Nov 2026 12:00:00 +0000MCP servers and clients had 2026 flaws giving RCE or OAuth credential theft. Update mcp-atlassian to 0.17.0, mcp to 1.30.0 or 2.2.0, and OpenCode to 1.18.33.ai-toolsai-toolspypiopen-sourcehttps://vulnpocalypse.dev/advisories/hades-pypi-ensmallen-bioinformatics/https://vulnpocalypse.dev/advisories/hades-pypi-ensmallen-bioinformatics/Mon, 02 Nov 2026 12:00:00 +0000Hijacked releases of ensmallen and other graph ML, bioinformatics and AI packages stole CI secrets on import. Kill gh-token-monitor before revoking tokens.supply-chainpypigithub-actionsci-cdai-toolshttps://vulnpocalypse.dev/advisories/trapdoor-npm-pypi-crates-stealer/https://vulnpocalypse.dev/advisories/trapdoor-npm-pypi-crates-stealer/Mon, 02 Nov 2026 12:00:00 +000034 lure packages on npm, PyPI and crates.io stole keys, wallets and cloud credentials and planted AI-agent rule files. Check for the names and rotate secrets.supply-chainnpmpypiopen-sourceai-toolscryptohttps://vulnpocalypse.dev/advisories/microsoft-durabletask-pypi-compromise/https://vulnpocalypse.dev/advisories/microsoft-durabletask-pypi-compromise/Mon, 02 Nov 2026 12:00:00 +0000durabletask 1.4.1, 1.4.2 and 1.4.3 stole cloud, Kubernetes and Vault secrets on import on Linux. Check for pgsql-monitor.service, then rotate and rebuild.supply-chainpypicloudci-cdhttps://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/https://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/Mon, 02 Nov 2026 12:00:00 +0000lightning 2.6.2 and 2.6.3 on PyPI stole credentials on import and spread via GitHub and npm. Check installs, rotate secrets, use 2.6.1 or 2.6.4+.supply-chainpypinpmphpai-toolsci-cdhttps://vulnpocalypse.dev/advisories/elementary-data-pypi-ghcr-backdoor/https://vulnpocalypse.dev/advisories/elementary-data-pypi-ghcr-backdoor/Mon, 02 Nov 2026 12:00:00 +0000elementary-data 0.23.3 on PyPI and its GHCR image ran a credential stealer via elementary.pth. Find 0.23.3, move to 0.23.4 or later, and rotate secrets.supply-chainpypigithub-actionsci-cdcloudhttps://vulnpocalypse.dev/advisories/litellm-sql-injection-cve-2026-42208/https://vulnpocalypse.dev/advisories/litellm-sql-injection-cve-2026-42208/Mon, 02 Nov 2026 12:00:00 +0000A pre-auth SQL injection in LiteLLM proxy 1.81.16 to 1.83.6 exposes API keys and provider credentials. Exploited. Upgrade to 1.84.0 or later and rotate keys.ai-toolsai-toolspypi