Executive Summary: This report analyzes a supply chain compromise involving malicious Xinference packages on PyPI, which were used to exfiltrate sensitive data, harvest cloud credentials, and target cryptocurrency wallets. On April 22, 2026, a user reported that Xinference version 2.6.2 looked suspicious. During installation, they noticed unusual server activity, which raised concerns about a possible security […]