TeamPCP strikes again: Xinference PyPI package compromised

TeamPCP has escalated its supply chain attack campaign by hijacking the legitimate xinference PyPI package, deploying an import-triggered payload to silently harvest and exfiltrate a wide range of secrets from AI and infrastructure environments—if you used versions 2.6.0-2.6.2, treat your systems as fully compromised.