❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware! TLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP. The malware combines two threats in one package: an infostealer that harvests secrets from the machine, and a remote access trojan (RAT) that lets the attacker connect remotely and control the affected machine. The malicious code was injected only into the “wheel” package, so reviewing the repository and the “clean source” would not have revealed anything wrong. The malware also contacts the URL litellm[.]dev, which is an attacker bought domain that could easily be seen as a legitimate domain instead. While this might look like “yet another PyPI malware”, hiding inside the wheel file is one of the new ways attackers use to stay hidden and bypass common detections, like in npm, whenever a new protection is added – such as blocking preinstall hooks, threat actors will go out of their ways to find new techniques to reach their goals and execute code without being detected. If you’re yet to pin versions or add a time-based installation delay, this should be yet another wake up call to take the time and do so before it is too late. Once these passwords and credentials are out, remediation will take longer than it takes threat actors to get what they want. Read the full blog: ox.security/blog/litellm-1-1…

First session at @InfoSec_World !

YESSS Let's GOOOO FIND ME AT SECTOR!

🚨 AI AGENTS IN DEEPSEEK HARNESS CAN DISABLE THEIR OWN SANDBOX 🚨 CVE-2026-82533, CVSS 9.4, DeepSeek Harness (dsh). 215,000+ GitHub stars, fastest growing repo. One. curl. command. = sandbox escape. 🤯 The harness ships an OS sandbox so a coding agent working on untrusted material can't reach your machine. DeepSeek did everything right, they just forgot that the agent inside sandbox can communicate with the host machine via localhost, oh, and they also forgot that you can tell the localhost to... DISABLE THE SANDBOX 🤦 And it's not just that it escaped, the logs show that the commands the agents send - are logged as the user itself, "source": {"kind": "user"} - meaning that the harness couldn't tell its own agent's shell from a real user that's typing them. Our team disclosed the vulnerability on Aug 24, and the issue was fixed on Aug 27 on 0.1.2-alpha.1. Recommended Actions: - Upgrade to 0.1.2-alpha.1 or later Read the full blog: ox.security/blog/cve-2026-82…

Excited to share that I'll be speaking at BSides Toronto! Catch my talk, "One IDE to Rule Them All - Securing Your Supply Chain's Weakest Link," on Oct 3rd. And if you're in the Toronto area around then, let's meet up!

🚨 Malware News: Threat actors abuse npm mirrors for hosting ClickFix & phishing campaigns. 🚨 Our threat intelligence engine flagged 24 original npm packages containing malicious HTML pages with redirection to attacker controlled domains. While installing these packages is a harmless act, the threat actors are doing something much more interesting - they are using the npm registry as a free hosting service, mirrored by countless registry mirroring services - they have legitimate domains presenting their malicious code with arbitrary redirection. You can read the full article here: ox.security/research-clickfi…

🪱 Shai-Hulud - 5 days after, what happened & what we've learned? Last week the worm hit 440+ npm packages (2B+ monthly downloads) and has now evolved to weaponize the official MCP Registry - an MCP server (V.A.P.E) is distributing the payload via poisoned Claude Code/VS Code settings files from it's GitHub repository. Infection lives inside malicious .vscode/settings.json and .claude/settings.json triggered directly when you clone and open the infected repositories inside VS Code or Claude Code. TL;DR: - 5 live GitHub repos still distributing the malware, one of them an official public MCP server - 3,800+ public repos with exfiltrated credential dumps still searchable - 2 malicious npm packages stayed live 72 hours before removal Compromised maintainer accounts are auto-spawning new infected repos Repos still shipping the malware - • github.com/techtoboggan/clau… • github.com/rainb0w-clwn/node… • github.com/diegobbarbosa09/A… • github.com/evilgodfahim/kal • github.com/jUXTAPOSITION1/V.… I argue that git clone is the new USB drive, what was worms spreading by AutoRun has now shifted to "Yes, I trust the authors", if Claude and VS Code are going to run custom configurations directly from a cloned repo, we're basically doomed to a command execution attack vector where the whole threat is based on the one button every developer clicks mindlessly without thinking. Read the complete article here: ox.security/blog/shai-hulud-…

Watch out from a new npm malware - shadxino (All versions) Threat actors directly steal ChatGPT sessions from your browsers Not sure we've seen attribution to this type of attack before

Malware-Slop strikes again, threat actor's private GitLab SSH keys found inside his npm malware. The malware - polymarket-key, with the obvious @Polymarket impersonation, targets crypto wallets (obviously) and tries to get them not just from the local machine, but also from crypto-wallet browser extensions like MetaMask. ox.security/blog/malware-slo…

npm is fighting the right war, with the wrong tools. Cooldowns, multi-factor auth, blocking pre-install scripts are a nice-to-have solutions, but they don't actually solve the real problem - malicious code. We're getting a hardened v12 promising to stop supply chain attacks, but under the hood the npm registry is still flooded with malware. Malware that's being blocked AFTER it's already published, a problem which Google and Apple solved years ago in their app marketplaces with automatic and manual reviews. It's time that Microsoft aligns and do the same. I wrote an article about it - ox.security/blog/npm-is-figh…

🚨 NPM Malware-slop Alert!🚨 We detected and reported a malware-slop package to npm - the malware uses it's OWN PRIVATE GitHub token, which is EMBEDDED INSIDE the malware itself - to read sensitive information and upload it to the threat actor's GitHub repository. The malware is still live on npm - npmjs.com/package/mouse5212-… The threat actor's GitHub page was opened 5h ago - github.com/unplowed3584 Detailed report will be published tomorrow.

TeamPCP: Attack of the Clones We detected the first ever out in the wild Shai-Hulud clone copying from the TeamPCP leaked source code last week. The Shai-Hulud variant is a part of a family of 4 different malwares by the same actor, including credential stealing logic, and also exfiltration of personal information (IP, Location, Hostname) AND a DDoS botnet server designed to attack servers directly from the victim's machine! The malwares are still live on npm, targeting developers via typo-squatting and Axios impersonation. For more details, and a full technical breakdown of all the four malicious packages: ox.security/blog/new-actors-…

🚨🚨 MALWARE MALWARE MALWARE 🚨🚨 Shai-Hulud hits npm & PyPi, affecting TanStack, Mistral AI, OpenSearch and many more. - Over 170 packages affected across npm & PyPi - Over 518M accumulated monthly downloads - git-tanstack[.]com is the C2 server - Russian language check still appears in the code We strongly recommend that security engineers and developers take immediate precautions: - Implement time-based install logic to only pull packages older than 24 hours - Enforce 2FA across npm, GitHub, and cloud accounts - Treat key rotation as a routine practice rather than an incident response measure. We wrote a blog about it - OX Security ox.security/blog/shai-hulud-…