Black October: LiteLLM credential stealer, npm worm and thousands of poisoned GitHub workflows

AIFlow_ML · x · 2026-10-23

A roundup of the October 5–22, 2026 supply-chain storm dubbed "Black October":

• LiteLLM 1.107.0 (PyPI + Docker, Oct 21) shipped a credential stealer via a .pth startup hook plus an hourly RCE loader; 1.106.2 is safe
• tensorlake 0.5.144 (npm) carried the self-spreading Shai-Hulud worm with a dead-man wipe switch; @subql/common 5.8.3 delivered a stealer + reverse shell via trusted publishing; OVHcloud CLI GitHub release assets were swapped, and Rank Math PRO's update channel got a self-restoring backdoor
• GhostAction workflows: tens of thousands of GitHub repos received malicious security-audit.yml workflows exfiltrating repo, cloud and AI secrets
• A certificate authority (eMudhra) had guessable keys; PHP, Node.js, GitLab, BIND and Unbound shipped urgent fixes, and CISA added six actively exploited CVEs in one day

Accompanying charts also flag the local-AI stack: exploited CVEs in LiteLLM and Langflow, a CVSS 9.2 bug in llama.cpp, 30+ advisories for vLLM <0.31.0, and Ollama path traversal and SSRF issues.

Related event: 'Black October': 27 Major Vulnerabilities and Supply-Chain Attacks Hit Open Source and Cloud Infrastructure(25 posts)→

Original post →

More from Infra

• HarnessRouter open-sources a unified API to run Codex, Claude Code and more as agent backends — tom_doerr · 2026-10-23
• Local AI security checklist: pin Ollama ≥0.35.0, vLLM ≥0.31.0, purge LiteLLM 1.107.0 malware — AIFlow_ML · 2026-10-23
• Open-source Bonsai 2 9B gets 471% faster on Macs after one-week community optimization challenge — gajesh · 2026-10-23
• July 28 MCP release makes remote servers stateless, biggest revision since launch — bibryam · 2026-10-23
• MCP keynote: AAIF hits 305 members, Skills over MCP and Tasks/Events roadmap revealed — bibryam · 2026-10-23
• Fizgig 8.9.0 adds multi-GPU LoRA training across PCs and rented pods — shootthesound · 2026-10-23

Infra channel →