Mastodawn

PSA: litellm 1.82.7 + 1.82.8 on PyPI are MALICIOUS.

Chained attack: Trivy (security scanner) compromised → litellm CI secrets stolen → PyPI account hijacked → poisoned packages published.

Malware harvests SSH keys, cloud creds, .env files, K8s configs, crypto wallets. Exfiltrated to a domain registered hours before.

If affected: uninstall, purge caches, ROTATE ALL CREDS, audit K8s, check CI/CD.

#InfoSec #SupplyChain #Python #GlassWorm #OpenSource #CyberSecurity

Niclas 4d ago

The most interesting supply chain attack I've ever seen: #trivy

The attack is really bizarre. I learned a lot about GitHub Actions and how the attack was performed.

- https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
- https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation
- https://ramimac.me/trivy-teampcp/#timeline
- https://snyk.io/articles/trivy-github-actions-supply-chain-compromise/

#cybersecurity #supplychain #github #glassworm #githubactions #attack #TeamPCP #c2

Update: Ongoing Investigation and Additional Activity

Open Source Security Advisory Update: Monday, March 23, 2026 Boston, MA 2:00 AM ET We are providing this update to share new developments identified during our ongoing investigation into the Trivy open source incident described below. Over the weekend, the Trivy team continued analysis of the previously reported incident and started implementing additional security measures across repositories and automation …

Aqua

Jack C.M 4d ago

#GlassWorm malware hides in invisible open-source code. Via @scientific_american #CyberSecurity

GlassWorm malware hides in inv...

GlassWorm malware hides in invisible open-source code

A cybercrime campaign called GlassWorm is hiding malware in invisible characters and spreading it through software that millions of developers rely on

Scientific American

CyberVeille.ch Mar 20

📢 La campagne GlassWorm s’intensifie via des extensions Open VSX malveillantes et 150+ dépôts GitHub compromis
📝 Selon The Hacker News, la campagne d’attaque de la chaîne d’approvisionn...
📖 cyberveille : https://cyberveille.ch/posts/2026-03-19-la-campagne-glassworm-sintensifie-via-des-extensions-open-vsx-malveillantes-et-150-depots-github-compromis/
🌐 source : https://www.scworld.com/brief/glassworm-supply-chain-attack-campaign-expands-further
#GitHub #GlassWorm #Cyberveille

Marcel SIneM(S)US Mar 19

Der "#Glassworm" treibt immer mehr Unwesen - inside-it.ch https://www.inside-it.ch/der-glassworm-treibt-immer-mehr-unwesen-20260318 #Malware

Der "Glassworm" treibt immer mehr Unwesen

Vor allem Entwickler werden durch manipulierte Pakete und Extensions auf Github und anderen Repositories gefährdet.

The New Oil Mar 19

#GlassWorm #malware hits 400+ code repos on #GitHub, #npm, #VSCode, #OpenVSX

https://www.bleepingcomputer.com/news/security/glassworm-malware-hits-400-plus-code-repos-on-github-npm-vscode-openvsx/

#cybersecurity

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions.

BleepingComputer

Endor Labs Mar 18

#GlassWorm compromised an #npm maintainer account, pushing 3 waves of malware across packages with 134K monthly downloads.

Endor Labs tracked 11 compromised versions across 4 packages and mapped the full infection chain + IoCs.

https://www.endorlabs.com/learn/npm-is-serving-malware-to-134k-developers

WordPress Meetup Dresden (DRS)Mar 17

https://t3n.de/news/github-schadsoftware-glassworm-1734075/

#Schadsoftware #Glassworm #GitHub #Wurm #Angriffswelle #Gefahr

Dutzende GitHub-Repositorys betroffen: Unsichtbare Schadsoftware Glassworm ist zurück | t3n

Im vergangenen Jahr hatte die unsichtbare Schadsoftware Glassworm mehrfach ihr Unwesen getrieben. Jetzt ist der gefährliche Wurm mit einer neuen Angriffswelle zurückgekehrt. Im Visier sind einmal mehr GitHub-Repositorys. Rund ein Jahr, nachdem Glassworm im März 2025 erstmals von der Sicherheitsfirma Aikido in bösartigen NPM-Paketen aufgespürt wurde, meldet sich die Schadsoftware mit einer neuen Angriffswelle zurück. […]

t3n Magazin

Show thread

decio Mar 17

Tiens, plot twist ! le bouzin pivote vers windows

"On March 16, a new Solana memo appeared on the published #GlassWorm wallet (28PKnu, documented by Truesec in October 2025) at 11:42 UTC with a kill-switch toggle set to OFF and a live payload URL. The campaign had reactivated. The payload was not the macOS stealer from Parts 1 and 2. It was a 202KB JavaScript file targeting Windows, bundling native DLLs, a Chrome browser extension disguised as "Google Docs Offline", a DPAPI credential dumper, and exfiltration to a previously unseen server."
👇
https://codeberg.org/tip-o-deincognito/glassworm-writeup/src/branch/main/PART3.md