hackerlogs: Model Supply Chain https://hackerlogs.com/topics/model-supply-chain Data and model poisoning, backdoored weights, unsafe serialisation formats, and provenance for models and datasets. en Wed, 09 Sep 2026 00:00:00 GMT UNC6780 Hid Dustmaker Where Coding Agents Look First. https://hackerlogs.com/blog/unc6780-dustmaker-workspaces https://hackerlogs.com/blog/unc6780-dustmaker-workspaces Wed, 09 Sep 2026 00:00:00 GMT Ajain Vivek Since March 2026, UNC6780, also tracked as TeamPCP, has compromised PyPI, npm, and Docker Hub. Its JavaScript stealer Dustmaker reads OIDC tokens from GitHub Actions runner process memory and publishes packages with valid SLSA Build 3 attestations. Those stamps pass automated trust checks used by AI coding agents. GTIG also saw hidden workspace dirs aimed at those agents.

Key takeaways

  • Dustmaker is a CI/CD-oriented JavaScript stealer. GTIG told The Hacker News the AI-workspace tricks are new versus earlier SANDCLOCK variants.
  • Stolen GitHub Actions OIDC from runner process memory lets the actor publish packages with valid SLSA Build 3 attestations that agent trust checks accept.
  • Payloads land in hidden assistant directories (.claude, .cursor, .vscode) that EDR watches less closely than cron or the registry.
  • Comment-bait at the top of the JavaScript loader is meant to make LLM scanners refuse the file, not to teach a jailbreak.
  • One IR case handed access to a second actor who used LAPSUS branding and stole a proprietary AI repository. There is no CVE.
]]> agentic-security model-supply-chain Probllama: What the Ollama RCE Teaches About Self-Hosted AI https://hackerlogs.com/blog/probllama-ollama-rce https://hackerlogs.com/blog/probllama-ollama-rce Sat, 05 Sep 2026 00:00:00 GMT Ajain Vivek CVE-2024-37032, Probllama, was a path-traversal flaw in Ollama's model-pull endpoint that let an attacker overwrite files and reach remote code execution, made worse because the default Docker image runs as root on all interfaces with no authentication. It was fixed in version 0.1.34. The lesson: self-hosted AI runtimes inherit no authentication by default.

Key takeaways

  • Probllama (CVE-2024-37032) turned insufficient digest validation in Ollama's /api/pull endpoint into arbitrary file write and remote code execution.
  • The default Docker deployment runs as root and binds 0.0.0.0 with no authentication, which is what turned a bug into remote, unauthenticated RCE.
  • Ollama committed a fix within hours and shipped it in 0.1.34; weeks later a large number of exposed instances were still unpatched.
  • The class is not specific to Ollama: model runners, vector stores, and notebook servers routinely ship with no auth and assume a trusted network.
  • Treat any self-hosted AI runtime as unauthenticated by default and put it behind a reverse proxy that is not.
]]> model-supply-chain llm-app-security CVE-2024-37032