The supply chain attack has now spread to PyPI:
mistralai: 2.4.6
guardrails-ai: 0.10.1
Pause your dependency updates or use package cooldowns (--uploaded-prior-to flag in latest pip)
Stay safe!
🚨 There was another supply chain attack, this time affecting tanstack npm packages. Make sure you haven't installed the compromised packages either in your CI or locally.
I would also hold off on updating any dependency for the next week or so until the dust settles from this.
Blog post with more information on all of this. Stay safe out there!
https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack