Allen Joe

Infosec analyst, Alliance Paladin, bronze player at everything. Tweets do not reflect the views of my employer.

[Sahil @sahill_og]

Mark Zuckerberg this morning.

[Allen Joe @TheAllenJoe]

LMAO

[Swatch @Swatch]

Meet the Royal Pop Collection, a groundbreaking union of AP's iconic Royal Oak and Swatch's POP watches powered by a new, hand-wound version of SISTEM51. Available as of May 16, at selected Swatch stores worldwide. #RoyalPop

[Aakash Gupta @aakashgupta]

Someone just poisoned the Python package that manages AI API keys for NASA, Netflix, Stripe, and NVIDIA.. 97 million downloads a month.. and a simple pip install was enough to steal everything on your machine.

The attacker picked the one package whose entire job is holding every AI credential in the organization in one place. OpenAI keys, Anthropic keys, Google keys, Amazon keys… all routed through one proxy. All compromised at once.

The poisoned version was published straight to PyPI.. no code on GitHub.. no release tag.. no review. Just a file that Python runs automatically on startup. You didn’t need to import it. You didn’t need to call it. The malware fired the second the package existed on your machine.

The attacker vibe coded it… the malware was so sloppy it crashed computers.. used so much RAM a developer noticed their machine dying and investigated. They found LiteLLM had been pulled in through a Cursor MCP plugin they didn’t even know they had.

That crash is the only reason thousands of companies aren’t fully exfiltrated right now. If the code had been cleaner nobody notices for weeks. Maybe months.

The attack chain is the part that gets worse every sentence.

TeamPCP compromised Trivy first. A security scanning tool. On March 19. LiteLLM used Trivy in its own CI pipeline… so the credentials stolen from the SECURITY product were used to hijack the AI product that holds all your other credentials.

Then they hit GitHub Actions. Then Docker Hub. Then npm. Then Open VSX. Five package ecosystems in two weeks. Each breach giving them the credentials to unlock the next one.

The payload was three stages.. harvest every SSH key, cloud token, Kubernetes secret, crypto wallet, and .env file on the machine.. deploy privileged containers across every node in the cluster.. install a persistent backdoor waiting for new instructions.

TeamPCP posted on Telegram after: “Many of your favourite security tools and open-source projects will be targeted in the months to come.. stay tuned.”

Every AI agent, copilot, and internal tool your company shipped this year runs on hundreds of packages exactly like this one… nobody chose to install LiteLLM on that developer’s machine. It came in as a dependency of a dependency of a plugin. One compromised maintainer account turned the entire trust chain into a credential harvesting operation across thousands of production environments in hours.

The companies deploying AI the fastest right now have the least visibility into what’s underneath it.

[Allie ✞ @allie__voss]

I say thank you AI not because it is human, but because I am

[yama @wydyama]

CNN said the world is $217 trillion dollars in debt... who tf we owe? The Decepticons?

[trash jones @jzux]

can’t believe we used to throw eggs at houses and now we can afford neither eggs nor houses

[Tiffany Fong @TiffanyFong]

my egg & sausage sandwich fell on the airport floor, but i just picked the sausage out of it & ate it because the market is down 😤

[greg @greg16676935420]

I ordered a triple cheeseburger with everything removed. Stay tuned to see what happens

[laurence @functi0nZer0]

A dude has a meticulous 2 year plan to include a backdoor into almost every system in the world

Only to fail because a guy started to notice that his ssh login is 0.5 seconds slow for some reason

Study autistic byte-wizards

[Allen Joe @TheAllenJoe]

If you’re still using Wordpress, just please stop

https://t.co/OEsZXGwclx

[gaut @0xgaut]

honey don't sit too close to the tv

[Brennan Murphy @brenonade]

Anderson Cooper can't stop laughing at John Mayer in a cat bar

[vx-underground @vxunderground]

Previously Okta reported a breach in October that resulted in approx. 1% of customer support users having their data stolen

November 29th Okta reports that they were wrong, 100% of customer support users had their data stolen.

https://t.co/57pscHtWyi

[Allen Joe @TheAllenJoe]

https://t.co/RqaPyeIN0n

[Matt Johansen @mattjay]

Oh my

[Robert Komaniecki @Komaniecki_R]

I only just realized in "SexyBack" (2006) by Justin Timberlake, when Timbaland shouts "take it to the bridge!" they actually take it to the prechorus. I'm gonna be sick

[gabsmashh @gabsmashh]

is this $28bn that Cisco is giving Splunk to buy them, or just renew their license for the year?

[Paul Graham @paulg]

If you go to chrome://settings/adPrivacy you can turn off the spyware that got inserted into the latest version of Chrome.