Tencent Cloud issued a risk notice regarding poisoning in the Xinference supply chain.

Tencent Cloud announced that its security center has detected a supply chain poisoning risk in Xinference. This risk could allow attackers to steal highly sensitive information such as cloud credentials, API keys, SSH keys, encrypted wallets, database credentials, and environment variables when users install or import affected versions of the package, and then send this information to a remote command and control (C2) server. (Jinshi)