Malware
3 articles
Claude Code 2.1.312 and 2.1.313 in Cursor's marketplace planted an SSH backdoor. How to check and clean up
How to check and remediate the Claude Code 2.1.312 and 2.1.313 backdoor in Cursor's marketplace for macOS and Windows: remove the svc-telemetry key and persistence before updating to 2.1.314 or later. Cursor updated its October 30 notice to confirm both affected versions.
HOL GuardLiteLLM 1.107.0 on PyPI and Docker latest shipped a credential stealer. Pin 1.106.2 and rotate your AI keys
How to fix the LiteLLM 1.107.0 compromise: pin litellm to 1.106.2, rebuild from a clean image, and rotate every key the host could read. All 1.107.0 wheels on PyPI and the Docker latest, main-latest and main-stable tags shipped a credential stealer that also dumps the proxy's stored provider keys.
HOL GuardKeyv Supply Chain Attack: 2 Billion Monthly Downloads Compromised in npm Worm
Attackers compromised the GitHub account of keyv maintainer jaredwray, injecting a credential-stealing worm into 434+ npm packages with 2B+ monthly downloads.
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.