New Shai-Hulud attack trojanizes 19 science-focused PyPI packages

Hackers compromised 19 packages on the PyPI, collectively downloaded hundreds of thousands of times, in a new Shai-Hulud ...
Dark Reading

'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud

Threat actors have struck the software supply chain yet again, this time hitting the Python Package Index (PyPI) with Mini Shai-Hulud in an attempt to spread poisoned code. In the latest campaign, ...
Hosted on MSN

Gmail servers hijacked by malicious PyPI packages to spread havoc - here's how to stay safe

Socket found seven malicious packages on PyPI The packages were abusing Gmail and WebSocket They were removed from the platform Several malicious PyPI packages were recently observed abusing Gmail to ...
Morning Overview on MSN

Three separate supply-chain attacks hit npm, PyPI, and Docker Hub within 48 hours — all three targeted developer cloud credentials and SSH keys

Sometime around the last week of May 2026, attackers uploaded poisoned packages to three of the most widely used software ...

Forcepoint details TeamPCP supply chain attack that turned LiteLLM into a credential stealer

A new report out today from cybersecurity company Forcepoint LLC’s X-Labs research team details a supply chain attack that compromised LiteLLM, a widely used open-source Python ...

Protect your enterprise now from the Shai-Hulud worm and npm vulnerability in 6 actionable steps

TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious versions anyway. The CI/CD Trust-Chain Audit Grid maps the six gaps it ...
The Hacker News

PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials

In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to conduct credential theft. As of writing, ...
PBS

WATCH: Markey asks Dr. Means if Trump's order promoting glyphosate production puts health at risk

President Donald Trump's nominee for surgeon general, Dr. Casey Means, faced questions on Wednesday about the president's recent executive order promoting more domestic production of glyphosate, an ...
PBS

WATCH: Surgeon General nominee Means says health problems reflect nation with a 'broken heart,' 'society losing its mind'

Dr. Casey Means, a wellness influencer allied with Health Secretary Robert F. Kennedy Jr., says she wants to address the root causes of chronic disease if chosen as the nation's doctor. Watch the clip ...
Mint

Nvidia stock unusually cheap at Chip Index, says Bernstein — What it means for investors

Nvidia Corp.’s valuation relative to the Philadelphia Stock Exchange Semiconductor Index has rarely been so attractive, and the multiple overall augurs well for future returns, according to Bernstein.
The New York Times

John Means tears his Achilles the same day he was set to sign with a team

John Means finished second in the AL Rookie of the Year voting in 2019 but has had poor luck with injuries since 2022. Mitchell Layton / Getty Images John Means can’t seem to catch a break. The lefty ...