Supply-chain attack on AI package reportedly led to terabytes of stolen credentials

Ars Technica reports that attackers compromised an AI-related software package and used it to scrape and exfiltrate terabytes of credentials from about 2,500 users. Based on the report, the incident is a software supply-chain attack with downstream exposure affecting users of the compromised package rather than a breach limited to a single AI company account database.