Poisoned Pipeline / Incidents / AS174

AS174 · 2025-11

WooCommerce carding PyPI package

PyPI

Socket: malicious PyPI package targets WooCommerce stores with automated carding attacks.

Mapped techniques

• T0109 Publish malicious artifact
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/malicious-pypi-package-targets-woocommerce-stores-with-automated-carding-attacks
• https://www.morphisec.com/blog/when-your-ai-coding-assistant-becomes-the-attack-the-hades-supply-chain-campaign/
• https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise