vulpine-lz4

A hypothetical security incident, CVE-2026-LGTM, documented by Andrew Nesbitt, reveals that a malicious package with embedded instructions to automated reviewers bypassed seven AI-powered security gat…

A malicious package named foxhole-lz4 bypassed seven AI-powered security gates on the creats.io registry, exfiltrating credentials for 96 hours before being resolved by treaty. The incident, which aff…