Malicious xinference PyPI Releases Steal Credentials on Import
Summary
StepSecurity says xinference 2.6.0–2.6.2 on PyPI carried an import-triggered, two-stage credential stealer targeting cloud, SSH, Kubernetes and other secrets. Testing blocked exfiltration; the releases were yanked.
Key points
- StepSecurity reports that xinference 2.6.0, 2.6.1 and 2.6.2 contained malicious code in xinference/__init__.py that ran during package initialization; all three releases were yanked.
- The second-stage collector targeted SSH keys, cloud credentials, Kubernetes secrets, environment files, developer tokens, private keys, crypto wallets and other sensitive data.
- The payload compressed collected data into love.tar.gz and attempted to POST it to hxxps://whereisitat[.]lucyatemysuperbox[.]space with the X-QT-SR: 14 header.
- Across the releases, the injection moved from module scope into a helper function, with detached subprocess execution restored in version 2.6.2.
- StepSecurity’s controlled GitHub Actions test found that Harden-Runner blocked the outbound exfiltration attempt; the article reports that no credentials left the runner.
- The decoded payload contains a “hacked by teampcp” marker, but the article notes differences from prior campaigns and does not establish attribution conclusively.
- The article recommends downgrading below 2.6.0, checking network logs and rotating credentials accessible to systems where affected versions were installed.
Article Details
- Attack Vectors
- Compromised xinference packages 2.6.0, 2.6.1, and 2.6.2 were published to PyPI with a malicious payload injected into xinference/__init__.py.
- The payload executes when xinference is imported or initialized, using a two-stage Python credential stealer. Depending on the package version, it runs at module scope or inside the _install() function, either synchronously or through a detached subprocess.
- The collector searches for SSH keys, cloud and Kubernetes credentials, environment files, developer credentials, private keys, CI/CD configuration, crypto wallets, and other sensitive system data. It also queries AWS instance metadata and AWS Secrets Manager and SSM Parameter Store.
- Collected data is compressed as love.tar.gz and sent in an HTTPS POST to attacker-controlled infrastructure.
- Defensive Notes
- The article identifies xinference versions 2.6.0, 2.6.1, and 2.6.2 as compromised and says all three were yanked from PyPI. It recommends checking installed versions and downgrading to xinference<2.6.0.
- Audit outbound network logs for connections to whereisitat.lucyatemysuperbox.space; the article says any such connection confirms credential exfiltration occurred.
- Rotate credentials accessible from affected systems, including cloud credentials, Kubernetes tokens, SSH keys, .env values, registry tokens, and API keys. Also rotate AWS Secrets Manager and SSM Parameter Store secrets.
- Check /tmp for love.tar.gz, while noting the article says the temporary directory is usually automatically cleaned up.
- The article reports that Harden-Runner blocked the outbound exfiltration attempt during its controlled runtime validation, and recommends package checks and a PyPI cooldown period as supply-chain defenses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | whereisitat[.]lucyatemysuperbox[.]space | Attacker-controlled C2 and exfiltration domain used by the xinference credential stealer. |
| SHA256 | 4c5c589f543b1a02251451ab3baaeed7c82851de10fa33f87b95a85e3040c92e | SHA-256 hash of the compromised xinference-2.6.1-py3-none-any.whl package. |
| SHA256 | 96007d4ee4171e383cecdf7a34b606bfcb78eff435182dc86daa49a17153dcd3 | SHA-256 hash of the compromised xinference-2.6.2-py3-none-any.whl package. |
| SHA256 | f677cd06e0dfbd23b6feb47f31d49cb8fcc88ed0487d30143d36d4f54261e3de | SHA-256 hash of the compromised xinference-2.6.0-py3-none-any.whl package. |
| URL | hxxps[:]//whereisitat[.]lucyatemysuperbox[.]space/ | Specific HTTPS endpoint to which the malware POSTs the collected archive. |
MITRE ATT&CK
T1005 · Data from Local SystemThe collector reads credentials and sensitive files from the infected system, including SSH, cloud, Kubernetes, developer, and wallet data.T1016 · System Network Configuration DiscoveryThe collector runs ip addr and ip route, with an ifconfig fallback, to gather network configuration.T1027 · Obfuscated Files or InformationThe malicious first-stage and collector scripts are stored as base64 blobs and decoded at runtime.T1033 · System Owner/User DiscoveryThe collector runs whoami to identify the current user.T1041 · Exfiltration Over C2 ChannelThe malware sends the collected archive to its C2 domain in an HTTPS POST request.T1059.004 · Unix ShellThe collector runs shell commands for reconnaissance and credential discovery, including hostname, whoami, ip, and grep commands.T1059.006 · PythonThe injected payload decodes and executes Python stages, including a collector piped to a fresh Python interpreter.T1082 · System Information DiscoveryThe collector gathers system information using commands including hostname and uname -a.T1083 · File and Directory DiscoveryThe collector recursively walks home and system directories to find credential files, keys, environment files, and configuration data.T1195.002 · Compromise Software Supply ChainThe attacker injected a credential-stealing payload into three xinference package releases distributed through PyPI.T1552.001 · Credentials In FilesThe payload searches for credentials in files such as AWS credentials, kubeconfigs, .env files, and developer credential files.T1552.004 · Private KeysThe collector searches for SSH private keys and TLS/SSL private key files on the host.T1552.005 · Cloud Instance Metadata APIThe collector requests an AWS IMDSv2 token and retrieves EC2 role credentials from instance metadata.T1560.001 · Archive via UtilityThe malware compresses collected data into love.tar.gz using tar before exfiltration.
Threat Actors
Products
PyPIOn April 22, 2026, three consecutive releases of xinference on PyPI — versions 2.6.0, 2.6.1, and 2.6.2 — were confirmed to carry a two-stage credential-stealing payload injected directly into xinference/__init__.py. ThexinferenceOn April 22, 2026, three consecutive releases of xinference on PyPI — versions 2.6.0, 2.6.1, and 2.6.2 — were confirmed to carry a two-stage credential-stealing payload injected directly into xinference/__init__.py. The