AI package supply‑chain breach exposes terabytes of user credentials

Executive Summary

Emergent.sh reported attackers compromised an AI package distribution pipeline and injected code that stole API keys, tokens and session data from about 2,500 users.

What Happened

Emergent.sh reported a major AI software supply‑chain incident in which attackers compromised a widely used AI package distribution pipeline and injected malicious code that scraped and exfiltrated user credentials during normal operation.[11] The breach affected approximately 2,500 users and resulted in the theft of terabytes of sensitive data, including API keys, access tokens, and session information used in AI model training and deployment workflows.[11] The report notes that the stolen data likely encompasses proprietary training data, cloud infrastructure secrets, and other assets critical to AI systems in SaaS and enterprise environments.[11]