xinference PyPI Compromise: TeamPCP-Style Credential Stealer
Date Observed: April 22, 2026Ecosystem: PyPI (Python)Targets: AI/MLOps teams, CI/CD pipelines, cloud-connected LLM inference environmentsAttack Type: Supply chain compromiseImpact: SSH keys, AWS/GCP/Azure/Kubernetes credentials, .env secrets, and CI/CD tokens exfiltrated to attacker-controlled infrastructure Key Takeaways On April 22, 2026, three consecutive releases of xinference versions 2.6.0, 2.6.1, and 2.6.2 were confirmed to carry a malicious two-stage […]