PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials
2026-04-30T19:24:15Z•937996b81afa847f31697aa3ff2a3d607819184e9bd17a2eff2d7ffdeee3b22c
CISA-KEVGitHubHuggingFaceLinuxPyPISQL-injectionWindowsactive-exploitationbackdoorcredential-theftcybercrimeidentity-theftmalicious-packagenpmprivilege-escalationransomwareremote-code-executionsupply-chainthreat-actor-activitywiper
What happened
Multiple high-impact software supply chain and vulnerability stories: PyTorch Lightning and intercom-client PyPI packages were compromised with malicious releases (credential theft) published 30 Apr 2026; a broad SAP-related npm supply chain campaign (Mini Shai‑Hulud) and other npm compromises (including DPRK-linked tactics) are stealing credentials; LiteLLM (CVE-2026-42208) and Hugging Face LeRobot (CVE-2026-25874) critical flaws are being actively exploited; a Linux local privilege escalation (Copy Fail, CVE-2026-31431) enables local root; GitHub has a critical RCE (CVE-2026-3854) exploitatb
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 937996b81afa847f31697aa3ff2a3d607819184e9bd17a2eff2d7ffdeee3b22c
- Enrichment time
- 2026-04-30T19:24:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.