Poisoned Pipeline / Platforms / PyPI
PyPI
38 mapped incident(s) that touched this platform or registry.
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
PyPIDocker / containersGit / GitHubGitHub ActionsDeveloper workstationLinux distro / packagesmacOS softwareWindows software
12 mapped techniques
Hijacked AI coding assistant spreads Shai-Hulud
PyPIGit / GitHubAI coding agentsVS Code / IDEDeveloper workstation
8 mapped techniques
PhantomRaven hidden HTTP npm dependencies
npmCircleCIGit / GitHubGitLabGitLab CIJenkinsPyPI
5 mapped techniques
Deep-Live-Cam malicious git dependency
PyPIGit / GitHubmacOS softwareWindows software
8 mapped techniques
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
4 mapped techniques
Unclaimed packages in official llms.txt files
npmPyPIAI coding agentsCDN / web assets
5 mapped techniques
GlassWorm across GitHub, npm, Open VSX, VS Code, Python
Git / GitHubnpmVS Code / IDEPyPIBrowser extensions
4 mapped techniques
Team PCP CI/CD secrets campaign
GitHub ActionsPyPICI/CD SaaSGitLab CIAzure PipelinesJenkinsBitbucketCircleCIAzureGitLabKubernetesMCP
12 mapped techniques
Telegram, Discord, and WhatsApp-developer malware packages
npmPyPIRubyGemsBrowser extensionsCDN / web assets
4 mapped techniques
Registry abuse, starjacking, OAST, and LLM-developer targeting
npmPyPIGit / GitHubAI coding agentsBrowser extensionsCDN / web assetsRubyGems
3 mapped techniques
DPRK Contagious Interview (BeaverTail / npm + git)
npmPyPIGit / GitHubVS Code / IDE
6 mapped techniques