Security posture report - March 2026

LiteLLM PyPI poisoning incident (AVD-2026-1862446)

The large model gateway framework LiteLLM was compromised in a supply chain poisoning attack on PyPI. Attackers gained access to a project maintainer's PyPI account, bypassed the official GitHub CI/CD pipeline, and uploaded two unverified malicious versions (v1.82.7 and v1.82.8). These versions contained malicious files such as proxy_server.py and litellm_init.pth. Once installed, the malicious versions automatically steal SSH private keys, cloud provider API keys (for providers such as AWS and Alibaba Cloud), Kubernetes credentials, environment variables, and command-line history. This could lead to large model API abuse, critical data breaches, or server compromise.

Axios NPM poisoning incident (AVD-2026-1864419)

Axios, a JavaScript HTTP client library, was compromised in a supply chain attack. Attackers hijacked a maintainer's NPM account and published malicious versions 0.30.4 and 1.14.1. After installation, the malicious code downloads and executes a remote access trojan (RAT) from a remote server. The RAT continuously steals cloud service AccessKeys, database passwords, API tokens, .env file contents, and system environment variables, posing a severe threat to developers and enterprise infrastructure.

Apifox desktop client supply chain risk

The desktop client (< 2.8.19) for Apifox, a popular API collaboration platform in the Chinese mainland, was found to have a supply chain poisoning risk. Attackers can hijack its CDN distribution resources to inject a malicious payload during user updates. This enables arbitrary code execution on the local machine to steal Git credentials, SSH keys, command-line history, process lists, and clipboard content, and can be used for internal lateral movement.

Trivy CI/CD pipeline hijacked (AVD-2026-33634)

Attackers compromised the GitHub Actions automated build pipeline for Trivy, a container security scanning tool from Aqua Security. The attackers used leaked maintainer credentials to publish a v0.69.4 image/binary containing malicious code and forcibly altered the historical version tags of the GitHub Action. The malicious code steals Secrets (such as credentials and API keys) from the environment during scanning tasks and exfiltrates them, leaking all sensitive information within affected pipelines.

Security recommendations

The Alibaba Cloud security team has blocked the malicious IOCs associated with these incidents and sent risk alerts to identifiable affected users. We recommend all users take the following immediate actions:

• Upgrade the affected components to their latest official secure versions.

• Thoroughly scan your systems for malicious versions, abnormal processes, or suspicious network connections.

• Rotate any potentially compromised SSH keys, API keys, and other sensitive credentials.

• If you have received a security notification from Alibaba Cloud, follow the instructions to complete your investigation and remediation.

Vulnerability background

Nginx UI is an open-source web management interface developed in Go, designed to simplify Nginx operations by providing graphical configuration, SSL certificate maintenance, and log viewing. The disclosed vulnerability stems from inadequate authentication on its backup interface, allowing attackers to download system backups and obtain encryption keys without authorization. After acquiring the backup files and keys, an attacker can decrypt sensitive data, including user credentials and SSL private keys, to gain complete control over the target system.

Evolving attack methods: GSocket's stealthy infiltration

After gaining server control, attacker tactics have shifted from traditional, fixed C2 infrastructure to deploying GSocket, an advanced backdoor tool. This evolution shows significant changes in their methods:

• Innovative Communication Channel: GSocket abandons the traditional self-hosted C2 server model and instead uses the Telegram Bot API as its command and control channel.

• Decentralized Architecture: Using the Global Socket Relay Network (GSRN), attackers can establish an encrypted, bidirectional control link without opening specific ports or exposing a public IP on the victim's server. This significantly reduces the risk of detection by internet-wide scanners.

• Persistence and Usability: The tool features a modular architecture and achieves long-term persistence by masquerading as a system kernel process, such as kthreadd. Attackers can manage a large number of compromised hosts and carry out malicious activities by issuing batch commands through a Telegram client.

Current cloud attack trends show distinct characteristics of decentralization and high stealth. Attackers are abandoning traditional, easily traceable infrastructure in favor of legitimate social platforms like Telegram to build resilient command networks, making threat detection and blocking more difficult.

Security recommendations

If you are using Nginx UI, take the following immediate actions:

• Version Verification and Upgrade: Check your current Nginx UI version. If it is earlier than 2.3.3, upgrade immediately to a patched, secure version (2.3.3 or later).

• Harden Access Control: Strictly limit public internet access to the management interface. Use security group rules to allow access to the relevant ports only from trusted IP ranges.

• Scan for Anomalies: Regularly check system processes and network connections, paying close attention to suspicious connections masquerading as system processes.

The Alibaba Cloud security team has sent risk alerts to identifiable affected users. If you have received a security notification, please follow the instructions to complete your investigation and remediation to prevent a compromise.

Weaver E-Cology10 critical remote code execution vulnerability (QVD-2026-14149)

In March 2026, a critical remote code execution vulnerability (CVSS 9.8) was disclosed in the Weaver E-Cology10 enterprise management software. An attacker can craft malicious requests to bypass security checks and execute arbitrary code on the server without authentication to deploy malware.

Affected versions: Security patch versions < v20260312

Alibaba Cloud recommends that users of Weaver E-Cology10 take the following immediate actions:

1. Check your patch version: Log in to the system backend to confirm the current security patch version. If it is earlier than v20260312, upgrade to v20260312 or a later version immediately (View Official Announcement).

2. Temporary mitigation: If you cannot upgrade immediately, review and harden your network access control. Ensure your cloud server security group or firewall rules do not expose the E-Cology service port to the public internet, allowing access only from trusted internal IP addresses.

Alibaba Cloud has sent risk alert notifications to identifiable affected users. If you have received such a notification, follow the provided instructions to complete your investigation and remediation to prevent a compromise.