Python Library xinference Compromised, TeamPCP Denies Involvement

The Python library xinference has been compromised, with malicious versions 2.6.0–2.6.2 identified by Jfrog. The attackers modified the library to include a note stating “Hacked by TeamPCP.” This incident points to a concerning trend of supply chain attacks targeting popular development ecosystems.

However, the situation is not straightforward. Cyber News - Erez Dasa reports that the TeamPCP group publicly denies responsibility, claiming the attackers are imposters. This introduces an element of misdirection, potentially a false flag operation aimed at attributing the attack to a specific group while obscuring the true perpetrators.

Regardless of attribution, the immediate impact is on developers using xinference. This type of compromise allows attackers to inject arbitrary code into downstream applications, leading to potential data theft, system control, or further lateral movement within affected environments.