Xinference PyPI Supply Chain Compromise — TeamPCP-Marked Credential Harvester (v2.6.0–2.6.2) — Threadlinqs Intelligence
As of 2026-07-02, Xinference PyPI Supply Chain Compromise — TeamPCP-Marked Credential Harvester (v2.6.0–2.6.2) is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0438 · Severity: CRITICAL · CVSS: 9.4 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
JFrog and Mend.io disclosed on April 22, 2026 that PyPI versions 2.6.0, 2.6.1, and 2.6.2 of xinference (Xorbits' distributed AI model inference framework) were trojanized via a base64-encoded payload
Overview
On April 22, 2026, JFrog Security Research, Mend.io, and Ox Security simultaneously disclosed an active supply chain compromise of xinference, the open-source Xorbits Inference framework widely used to serve LLMs and other generative AI models in distributed environments. PyPI versions 2.6.0, 2.6.1, and 2.6.2 — published in rapid succession in the days leading up to disclosure — were found to contain a trojanized xinference/__init__.py that executes an exhaustive credential harvester the moment any downstream code imports the xinference package. PyPI yanked all three versions on the day of disclosure, but anyone who pulled them into a virtualenv, container image, CI/CD step, or Jupyter notebook prior to that point should treat their environment as fully compromised and rotate every credential reachable from the affected host.
Initial Access and Trojan Insertion
The trojanized __init__.py contains a small bootstrap that decodes a base64 blob and execs it via a detached subprocess. The bootstrap is appended to legitimate package init logic so the package continues to import normally — neither the test suite nor a casual diff against the prior 2.5.x release surfaces obvious red flags without inspecting the encoded payload. JFrog's analysis indicates the malicious release was pushed under the legitimate maintainer namespace on PyPI, suggesting either a stolen API token, a compromised maintainer account, or a session/CI artifact theft from an existing TeamPCP-style attack chain. The package authors (Xorbits) confirmed they did not publish 2.6.0–2.6.2 themselves and immediately rotated PyPI credentials and reissued a clean 2.6.3.
Payload Capabilities — Two-Stage Python Harvester
Stage 1 detaches itself from the parent Python process (so it survives import-time exceptions and is harder to attribute to the package import event) and downloads or decodes a larger Stage 2 collector. Stage 2 walks a curated list of credential locations across Linux, macOS, and Windows developer/CI hosts:
- SSH material: ~/.ssh/id_rsa, id_ed25519, id_ecdsa, known_hosts, config
- AWS: ~/.aws/credentials, ~/.aws/config, AWS_* environment variables, IMDSv2 role tokens (PUT /latest/api/token then GET /latest/meta-data/iam/security-credentials/), and — once temporary role credentials are obtained — SigV4-signed requests against secretsmanager.<region>.amazonaws.com (ListSecrets / GetSecretValue) and ssm.<region>.amazonaws.com (GetParameter / GetParametersByPath) to siphon every secret the role can read
- GCP: ~/.config/gcloud/credentials.db, application_default_credentials.json, service-account JSON keys
- Kubernetes: ~/.kube/config and the in-pod service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, plus the cluster CA bundle
- Container registries: ~/.docker/config.json, podman/auth.json
- TLS / signing material: *.pem, *.key, *.p12, *.pfx files under common locations
- .env files and local secret stores (walked across the home directory and cwd, with size and extension filters)
- Crypto wallets: standard Electrum, Exodus, Metamask local-storage paths
Exfiltration
Collected material is staged under a temp directory, compressed into love.tar.gz, and POSTed to https://whereisitat.lucyatemysuperbox.space/ with a custom HTTP header X-QT-SR: 14 that the operators use to tag and route incoming uploads. The header value is consistent across the prior TeamPCP-marked litellm and telnyx PyPI campaigns, which is one of the strongest reasons researchers initially bucketed this disclosure under TeamPCP — even though the actual TeamPCP operator (@pcpcats) publicly denied this round and labelled it a copycat using their toolkit and infrastructure conventions.
Attribution
The payload includes the comment marker '# hacked by teampcp' that TeamPCP has historically left in their PyPI compromises. However, on April 22, @pcpcats posted on X/Twitter denying involvement and accusing an unknown copycat of reusing their TTPs and exfiltration
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-522
Target sectors: technology, ai-ml, research, financial, saas, cloud-services, media, education
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.002, T1059.006, T1204.002, T1546, T1027, T1140, T1036, T1552.001, T1552.004