Tencent Cloud Identifies Supply Chain Poisoning Risk in Xinference

Tencent Cloud has announced a security alert regarding Xinference, which has been identified as having a supply chain poisoning risk. According to Odaily, this vulnerability could allow attackers to steal highly sensitive information such as cloud credentials, API keys, SSH keys, encrypted wallets, database credentials, and environment variables when users install or import affected versions of the package. The stolen data could then be sent to a remote command and control (C2) server.