GHSA-xmpw-2vmm-p4p6: Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Summary

A malicious version, guardrails-ai 0.10.1, was published to PyPI on May 11, 2026 at approximately 6:00 PM Pacific by an attacker. Anyone who installed guardrails-ai==0.10.1 from PyPI that day is affected, and PyPI quarantined the repository after researchers identified the package within about 2 hours. The maintainers report no requests to Guardrails AI infrastructure from the malicious version and no evidence of user data exfiltration through their systems.

Mitigation

Downgrade to guardrails-ai==0.10.0, which is unaffected, since no patched version above 0.10.1 is available yet. While the PyPI quarantine is active, install from GitHub with pip install git+https://github.com/guardrails-ai/guardrails.git@v0.10.0. If 0.10.1 was installed, treat the host as potentially compromised, rotate any credentials accessible from it (GitHub PATs, cloud provider keys, package registry tokens, API keys), and audit the GitHub account for unauthorized workflows or repositories. Snowglobe and Guardrails Hub API keys will be invalidated at 2:00 PM Pacific on May 13, 2026, so rotate them before then.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• guardrails-aiPyPILLM dependency since 2023-03-13 · 1 tracked dependent

Topics

• Model and package supply chain

Related items

• HighCVE-2026-86063: Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow…Similar attack · NVD/CVE Database
• MediumOver 1,500 npm packages exposed by Trusted Publishing validation flawSimilar attack · CSO Online
• InfoSkillScreen: High-Recall Screening of Malicious Agent Skills with Decision ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCVE-2026-108958: TensorLayer HDF5 model loading deserialization via model_config argumentSimilar attack · NVD/CVE Database
• InfoIntroducing Security for AI Coding Agents and Workstations | Endor LabsSimilar attack · Endor Labs Blog