A Poisoned Xinference Package Targets AI Inference Servers

Mend reported three malicious xinference PyPI releases (2.6.0–2.6.2) that execute on import to collect exhaustive credentials (SSH keys, cloud IAM tokens, Kubernetes tokens, Docker and DB credentials, and multiple cryptocurrency wallet formats) and POST them to a C2 endpoint (https://whereisitat.lucyatemysuperbox.space/) with a custom header. The implant uses double-base64 payloads, creates a transient gzipped staging archive (love.tar.gz), leaves no persistence artifacts, and therefore requires rotation of any exposed credentials; the campaign mirrors prior TeamPCP waves though attribution is disputed.