Malicious npm and PyPI package releases target developer credentials

Security researchers have identified two significant supply chain attacks targeting developer environments through malicious package releases on npm and PyPI.

In the npm ecosystem, the tensorlake@0.5.144 release was flagged as malicious. The attack involved pushing changes directly to the main branch of the tensorlakeai/tensorlake repository under a maintainer’s identity. This release included a preinstall payload designed to seek credentials and spread via stolen npm and GitHub tokens. The malware also installed a token monitor capable of deleting a user's home directory if a token was revoked.

Simultaneously, a malicious version of the LiteLLM package (v1.107.0) was uploaded to PyPI, with trojanized versions also appearing in LiteLLM Docker containers on GHCR and Docker Hub. Upon starting a Python interpreter, the malware executes a routine to harvest sensitive data from browsers, cloud providers, and AI services. The credential stealer, named ‘privcollect’, encrypts and exfiltrates gathered secrets to an attacker-controlled domain impersonating LiteLLM infrastructure.