{"slug": "nexus-repository-pro-your-ai-agent-is-pulling-malicious-packages", "title": "Nexus Repository Pro+: Your AI Agent Is Pulling Malicious Packages", "summary": "Sonatype launched Nexus Repository Pro+ to defend against supply-chain attacks that target autonomous AI coding agents installing packages and configuring MCP servers without human review. The launch follows a LiteLLM 1.107.0 release that sat live on PyPI for two hours with a credential stealer in every wheel, exposing AWS keys, GitHub tokens and Anthropic API credentials to anyone who ran pip install litellm during that window after an attacker compromised a developer release pipeline.", "body_md": "Yesterday, LiteLLM 1.107.0 was live on PyPI for two hours with a credential stealer embedded in every wheel. Anyone who ran pip install litellm during that window handed over AWS keys, GitHub tokens, and Anthropic API credentials to an attacker who had compromised a developer release pipeline. That attack targeted developers making a manual install. The scarier problem targets your AI coding agent, which installs packages, configures MCP servers, and pulls dependencies all day, autonomously, without anyone reviewing a single pull. Sonatype new Nexus Repository Pro+ is built specifically for this problem. The Problem Nobody Has Solved Yet Traditional supply […]\n\nThe post", "url": "https://wpnews.pro/news/nexus-repository-pro-your-ai-agent-is-pulling-malicious-packages", "canonical_source": "https://byteiota.com/nexus-pro-plus-ai-agent-supply-chain/", "published_at": "2026-10-22 03:14:46+00:00", "updated_at": "2026-10-22 03:40:53.840327+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "agent-protocols"], "entities": ["Sonatype", "Nexus Repository Pro+", "LiteLLM", "PyPI", "AWS", "GitHub", "Anthropic"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/nexus-repository-pro-your-ai-agent-is-pulling-malicious-packages", "markdown": "https://wpnews.pro/news/nexus-repository-pro-your-ai-agent-is-pulling-malicious-packages.md", "text": "https://wpnews.pro/news/nexus-repository-pro-your-ai-agent-is-pulling-malicious-packages.txt", "jsonld": "https://wpnews.pro/news/nexus-repository-pro-your-ai-agent-is-pulling-malicious-packages.jsonld"}}