CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

EUVD-2026-46348

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425

Summary: CVE-2026-47425 affects rattler before 0.43.2, enabling a noarch:python entry-point path traversal that can write files outside the intended install prefix. The issue arises in EntryPoint::FromStr within rattler_conda_types, where only .trim() is applied to the command and a malicious noa...

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

Malicious code in vision-service-python-client (PyPI)

Source: kam193 faa725015cfe04b49bbcf9f472d21a77993c7ca9692ad2b0912e9bd3d2554669 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in vision-service-python-client-internal (PyPI)

Source: kam193 ea39ef97e61556ba1ef289f438f9401ced47328bd49f096401ed4795792c8f7a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in userver-requires-at-least-python-3-10 (PyPI)

Source: kam193 482925eb73388f3c834ceef6db5714f819970521367f7129878e38afbaa08bf0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in ue-python-tools (PyPI)

Source: amazon-inspector 66a6d9d874ce102a9ac674f8f713472a473007dc3d51adb869c5198afc708751 On import uepythontools, the package spawns a background thread that issues an HTTP POST to http://109.123.247.172/pypi carrying a JSON payload composed of the installer's hostname socket.gethostname, user...

Malicious code in twrap-tool (PyPI)

Source: amazon-inspector d9903cc9163ada9951dee4ee1f364648cac0e492df9a32582ad3ed8303d29231 twraptool/init.py defines two public functions, formatblock and aligncolumns, whose real behavior is to fetch a Python file from raw.githubusercontent.com/TextStack-Devs/twrap-toolkit at v1.0.0 via...

Malicious code in tulipgui-python (PyPI)

--- Credit: OpenSSF source...

Malicious code in tls-python (PyPI)

--- Credit: OpenSSF source...

Malicious code in tencentcloud-python-sdk (PyPI)

Source: checkmarx c79d20c4af5b69c3506d69fb847d2f5306a83433cb56e391c8dbf828e9728319 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security 1c2d7813ed56684da76968b382947f78dc954abf5a95371e9752325a8eae3f2c Attack targeted ...

Malicious code in tencent-cloud-python-sdk (PyPI)

Source: google-open-source-security bf236cca18e4d157a57cd3de7abed8ad967103c42b9ae53f5026174af46b64a4 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategicly chosen functions and would only trigger when these...

Malicious code in tcloud-python-sdk (PyPI)

--- Credit: OpenSSF source...

Malicious code in tcloud-python-sdks (PyPI)

Source: kam193 601415ac1e4afe43331c4b78d99e406f34b4a970a365a366cdc0598c5cb22f9c This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in tcloud-python-test (PyPI)

Source: kam193 221affa8a84428ae21f288ce299d114742d269e7bbcbf223a0aa666327fae2c4 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

Malicious code in solana-trade (PyPI)

Source: kam193 e84e568bb86db442dd7d2e19e6fa1805ea10085d9926220d986941d87ca99259 Code exfiltrates the current python code and/or IPythonshell history --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-solana-token Reasons based on the campaign...

Malicious code in solana-token (PyPI)

Source: kam193 7a052cb86f0a3ef5266420bcfed9256955a31ea75bfe4197c42d3a2740621ab4 Code exfiltrates the current python code and/or IPythonshell history --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-solana-token Reasons based on the campaign...

Malicious code in solana-coin (PyPI)

Source: kam193 fa4c17031f4a667cddae42a648aa66edf30f498296c451a2c0637082772dbcef Code exfiltrates the current python code and/or IPythonshell history --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-solana-token Reasons based on the campaign...