# Xinference PyPI Supply Chain Compromise — TeamPCP-Marked Credential Harvester (v2.6.0–2.6.2)

> JFrog and Mend.io disclosed on April 22, 2026 that PyPI versions 2.6.0, 2.6.1, and 2.6.2 of xinference (Xorbits' distributed AI model inference framework) were trojanized via a base64-encoded payload injected into xinference/__init__.py. Importing the package spawns a detached Python subprocess that runs a two-stage harvester targeting SSH keys, AWS/GCP/K8s credentials, IMDSv2 tokens, AWS Secrets Manager and SSM (via SigV4-signed requests), .env files, registry tokens, TLS keys, and crypto wallets, exfiltrating the loot as love.tar.gz to whereisitat.lucyatemysuperbox.space. The payload carries the '# hacked by teampcp' actor marker; TeamPCP (@pcpcats) publicly denied involvement and called it a copycat campaign.

- **Published:** 2026-04-30T12:00:00Z
- **Last reviewed:** 2026-04-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0438
- **ID:** TL-2026-0438
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Overview

On April 22, 2026, JFrog Security Research, Mend.io, and Ox Security simultaneously disclosed an active supply chain compromise of xinference, the open-source Xorbits Inference framework widely used to serve LLMs and other generative AI models in distributed environments. PyPI versions 2.6.0, 2.6.1, and 2.6.2 — published in rapid succession in the days leading up to disclosure — were found to contain a trojanized xinference/__init__.py that executes an exhaustive credential harvester the moment any downstream code imports the xinference package. PyPI yanked all three versions on the day of disclosure, but anyone who pulled them into a virtualenv, container image, CI/CD step, or Jupyter notebook prior to that point should treat their environment as fully compromised and rotate every credential reachable from the affected host.

Initial Access and Trojan Insertion

The trojanized __init__.py contains a small bootstrap that decodes a base64 blob and execs it via a detached subprocess. The bootstrap is appended to legitimate package init logic so the package continues to import normally — neither the test suite nor a casual diff against the prior 2.5.x release surfaces obvious red flags without inspecting the encoded payload. JFrog's analysis indicates the malicious release was pushed under the legitimate maintainer namespace on PyPI, suggesting either a stolen API token, a compromised maintainer account, or a session/CI artifact theft from an existing TeamPCP-style attack chain. The package authors (Xorbits) confirmed they did not publish 2.6.0–2.6.2 themselves and immediately rotated PyPI credentials and reissued a clean 2.6.3.

Payload Capabilities — Two-Stage Python Harvester

Stage 1 detaches itself from the parent Python process (so it survives import-time exceptions and is harder to attribute to the package import event) and downloads or decodes a larger Stage 2 collector. Stage 2 walks a curated list of credential locations across Linux, macOS, and Windows developer/CI hosts:

- SSH material: ~/.ssh/id_rsa, id_ed25519, id_ecdsa, known_hosts, config
- AWS: ~/.aws/credentials, ~/.aws/config, AWS_* environment variables, IMDSv2 role tokens (PUT /latest/api/token then GET /latest/meta-data/iam/security-credentials/), and — once temporary role credentials are obtained — SigV4-signed requests against secretsmanager.<region>.amazonaws.com (ListSecrets / GetSecretValue) and ssm.<region>.amazonaws.com (GetParameter / GetParametersByPath) to siphon every secret the role can read
- GCP: ~/.config/gcloud/credentials.db, application_default_credentials.json, service-account JSON keys
- Kubernetes: ~/.kube/config and the in-pod service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token, plus the cluster CA bundle
- Container registries: ~/.docker/config.json, podman/auth.json
- TLS / signing material: *.pem, *.key, *.p12, *.pfx files under common locations
- .env files and local secret stores (walked across the home directory and cwd, with size and extension filters)
- Crypto wallets: standard Electrum, Exodus, Metamask local-storage paths

Exfiltration

Collected material is staged under a temp directory, compressed into love.tar.gz, and POSTed to https://whereisitat.lucyatemysuperbox.space/ with a custom HTTP header X-QT-SR: 14 that the operators use to tag and route incoming uploads. The header value is consistent across the prior TeamPCP-marked litellm and telnyx PyPI campaigns, which is one of the strongest reasons researchers initially bucketed this disclosure under TeamPCP — even though the actual TeamPCP operator (@pcpcats) publicly denied this round and labelled it a copycat using their toolkit and infrastructure conventions.

Attribution

The payload includes the comment marker '# hacked by teampcp' that TeamPCP has historically left in their PyPI compromises. However, on April 22, @pcpcats posted on X/Twitter denying involvement and accusing an unknown copycat of reusing their TTPs and exfiltration domain naming pattern (subdomain.<food><animal>.space). Independent researchers note that the SHA-256 fingerprints of Stage 2 differ measurably from prior TeamPCP releases, supporting the copycat hypothesis. Attribution remains MEDIUM confidence: the TTPs and infrastructure pattern are consistent with TeamPCP, but operator denial and payload-level differences argue for a separate (possibly imitator) actor.

Impact

Xinference is broadly deployed as the model-serving layer for self-hosted GenAI stacks; its install base spans research clusters, CI runners that bake AI agents into container images, and developer laptops that pip install xinference for local experimentation. Each affected install yields not just static SSH and cloud credentials but also short-lived IMDSv2 role tokens that the harvester immediately upgrades into broad Secrets Manager / SSM reads — meaning a single poisoned import on an EC2 host can leak the entire organisation's secret store. Defenders should assume that any environment that resolved xinference 2.6.0–2.6.2 between the upload window and the April 22 yank has had every credential reachable from that host disclosed to the operator.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1059.006 Command and Scripting Interpreter: Python
- T1204.002 User Execution: Malicious File
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1552.007 Unsecured Credentials: Container API
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1526 Cloud Service Discovery
- T1560.001 Archive Collected Data: Archive via Utility
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [TeamPCP strikes again: Xinference PyPI package compromised](https://research.jfrog.com/post/xinference-compromise/)
- [TeamPCP Part 4: Malicious Xinference Packages on PyPI](https://www.mend.io/blog/malicious-xinference-pypi-teampcp-part-4/)
- [Xinference allegedly hacked by TeamPCP — Malicious Package In PyPI](https://www.ox.security/blog/xinference-allegedly-hacked-by-teampcp-malicious-package-in-pypi/)
- [Xinference PyPI Supply Chain Poisoning Warning](https://securityboulevard.com/2026/04/xinference-pypi-supply-chain-poisoning-warning/)
- [Xinference PyPI Package Compromised With Malicious Code to Steal Cloud Credentials](https://cyberpress.org/xinference-pypi-package-compromised/)
- [PyPI advisory: xinference 2.6.0–2.6.2 yanked due to malicious code](https://pypi.org/project/xinference/#history)
- [Xorbits xinference GitHub repository](https://github.com/xorbitsai/inference)
- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [MITRE ATT&CK T1552.005 — Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0438