Python and Node.js Supply Chain Attacks (October 2026): What Happened and How to Protect Your Business

Most people picture a cyberattack as someone breaking into a website. The attacks in this article work differently. The attacker never touches your site. They poison a free software package that developers download and trust, and wait for the harmful update to arrive on its own.

In recent months, popular packages for Python and Node.js (the two ecosystems behind a huge share of modern websites, apps and AI tools) have been compromised in this way. The common goal is to steal what a developer’s computer or build server holds: passwords, cloud keys, payment and AI service tokens, and access to your code.

This article reflects what security researchers and government agencies had published by October 23, 2026. Some details are still being investigated and may change.

The incidents at a glance

1. LiteLLM on PyPI: a backdoored AI library (October 21)

LiteLLM is a widely used Python library that lets applications talk to many AI services through one interface. On October 21, 2026, version 1.107.0 was published to PyPI, Python’s main package registry, with malicious code inside it. Security firms StepSecurity and OX Security both analysed it.

• How it got there. According to the analysis summarised by StepSecurity, the release was built from a look-alike copy of the project’s repository with extra commits added. The project’s own post-mortem says an attacker used stolen access tokens. How the attacker first got in has not been confirmed.
• What it does. The malware runs every time Python starts on the machine, even in projects that never use LiteLLM. It hunts for browser passwords, SSH and cloud keys (AWS, Azure), GitHub and CI secrets, environment variables and the configuration of AI coding tools. It also contains a remote-access component that checks in with the attacker hourly and can run new code.
• How long it was live. The PyPI files were up for roughly one hour and forty minutes (about 11:39 to 13:23 UTC). Official Docker images were also affected for a few hours. That is short, but automatic builds and servers that update on their own can pull a bad version within minutes.
• Not the first time. StepSecurity notes this is the second LiteLLM compromise on PyPI this year, after versions 1.82.7 and 1.82.8 in March.

If you installed or upgraded to LiteLLM 1.107.0 anywhere, treat that machine as compromised. The security firms name 1.106.x as the last clean release.

2. The “Shai-Hulud” npm worm (Keyv and related packages)

On August 6, 2026, the Cyber Security Agency of Singapore warned of an active attack on the npm registry, the main package store for Node.js. Malicious versions of Keyv, a popular caching library, and many related packages carried malware from the “Shai-Hulud” family, described as a self-spreading variant.

• Scale. More than 1,300 compromised package versions, in packages with a combined 2 billion downloads a month.
• Behaviour. It steals developer credentials, then uses them to compromise further packages. A worm like this grows on its own, which is why it spread into the software supply chains of several organisations.
• Named packages in the advisory include keyv, flat-cache, file-entry-cache, cacheable-request and cache-manager, many of them used indirectly by tools you may never have heard of.

3. A flaw in npm’s publishing trust (fixed October 2)

Researchers at Bloom Security found that npm’s “Trusted Publishing” feature, meant to make releases safer, identified the linked GitHub repository only by its name. If the owner renamed, moved or deleted that repository, an attacker could register the old name and then publish new versions of the package without stealing any password. More than 1,500 packages were exposed, with over 10 million downloads in total.

GitHub announced a fix on October 2, 2026. It is not known whether anyone abused the flaw in the wild. Because such a release would carry a valid-looking “provenance” stamp, the researchers warn that even trust signals need checking. Package maintainers should review their linked repositories (npm trust list) and re-create any that point at a renamed or moved repository.

What these attacks cost a business

You do not need to be a software company to be affected. If your website, shop, app or internal tools are built on Python or Node.js, someone installed these packages on your behalf. When a developer machine or build server is compromised, the consequences reach well beyond that one computer:

• Cloud takeover. Stolen cloud keys let attackers run their own workloads on your account (a surprise bill), copy databases or delete backups.
• Customer data theft. Database passwords and API tokens open the door to customer records, orders and private documents, which can trigger breach-notification duties and fines.
• Your own code and website altered. With access to your repositories and deploy keys, attackers can add backdoors or malicious scripts that attack your visitors.
• Further spread. Your credentials can be used to poison other packages or customers, as the Shai-Hulud worm does.
• Downtime, clean-up and lost trust. Every credential must be replaced and machines rebuilt, often while the business is trying to operate.

What to do right now

1. Search for LiteLLM 1.107.0 in every environment: developer laptops, servers, containers and CI pipelines. Pin to a clean 1.106.x release. Rebuild rather than clean in place.
2. Check your Node.js projects against the package list in the Singapore advisory, including indirect dependencies. Your developer can run npm ls keyv and similar for each name.
3. If anything affected was installed, rotate secrets. Replace cloud keys, SSH keys, API tokens, database passwords and CI secrets that machine could reach, starting with the most powerful.
4. Check for signs of misuse: unfamiliar logins, new access keys, unexpected cloud resources, and traffic to the domains in the published indicators.
5. Ask your developer or agency in writing whether any of this applies to your systems and what they found.

How to protect yourself from the next one

There will be another poisoned package. The aim is to make sure it cannot do much when it arrives. These habits work for Python, Node.js and other ecosystems such as PHP’s Composer, Ruby and Java:

• Install from lockfiles. Use npm ci and pinned, hash-checked Python installs (pip install --require-hashes) so a new bad version is not pulled in automatically.
• Do not adopt brand-new releases instantly. Waiting a few days before updating gives researchers time to spot a bad release. Review updates before they reach production.
• Limit what install scripts can do. Where possible, install with scripts disabled (npm install --ignore-scripts) and run builds in a clean, disposable environment.
• Keep secrets off laptops and out of plain files. Use a secrets manager and short-lived credentials, so stolen keys expire quickly.
• Least privilege. A build job should only be able to do what that job needs. Use separate keys for development, testing and production.
• Turn on multi-factor authentication for GitHub, npm, PyPI, cloud and email accounts, and protect release workflows with branch rules and required reviews.
• Watch outbound traffic. A server or build machine that suddenly talks to an unknown domain is an early warning sign.
• Scan dependencies continuously with tools such as npm audit and pip-audit, and keep an inventory of what each project uses.
• Have a rehearsed response plan: who rotates which keys, in what order, and how to rebuild clean systems.
• Stay patched everywhere. The same week, PHP shipped critical fixes; see our guide to the October 2026 PHP vulnerabilities.

Need a hand?

Software supply chain risk is hard to see from the outside. DevSeguro combines web development and cybersecurity: we build with secure dependency practices from day one, and we review existing websites and applications for exposed secrets, risky packages and weak deployment settings. See our Security Check and assessments or our maintenance plans, or contact us and we will tell you what we would fix first.

Sources

• Cyber Security Agency of Singapore, advisory AD-2026-009 on the Keyv / Shai-Hulud npm attack, August 6, 2026
• StepSecurity: litellm 1.107.0 compromised on PyPI, October 21, 2026
• OX Security: LiteLLM 1.107.0 compromised with a RAT and infostealer
• Help Net Security: npm Trusted Publishing flaw exposed 1,500+ packages, October 13, 2026
• Datadog Security Labs: earlier LiteLLM and Telnyx compromises on PyPI, March 2026

DevSeguro Team

We write about what we actually do — build and secure things.