Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper handling of namespaced or prefixed script elements and case-sensitive matching of JavaScript URIs in the removeScripts plugin. An attacker can execute arbitrary scripts in the context of...

GHSA-2P49-HGCM-8545 SVGO removeScripts plugin leaves some executable scripts intact

Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...

SVGO removeScripts plugin leaves some executable scripts intact

Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...

Malicious code in xcepthttp (PyPI)

Source: kam193 98504a58d8dccbb3ea09cc521e14c9a64707763302db04111ad32eeba8616925 Importing the module starts downloading and executing first a script, and then a widely identified malware Packages are used as dependencies in a GitHub project https://github.com/ToolParadiseDrako/Nuker-Tool-Paradise...

Malicious code in websynapse (PyPI)

Source: kam193 7323a05444284204de7701ff8b7a738bc155cb22356cf93fc1399dedad5afa46 The package contains highly obfuscated content, that install another, downloaded from a remote location obfuscated script in the installation path of the 'requests' package, and marks it as a hidden system file. In...

Malicious code in urlsssser (PyPI)

Source: kam193 242b446cd6cce908f668bfc1b199aa8f54a9ee1138b399ea6012f3b2bd2624e8 Package does not contain malicious code, but was published as a part of the malicious campaign and is used during further infection stages --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in urlsser (PyPI)

Source: kam193 c4f6d5a2656d3741fd7a1a4c50a9d3332a09874ef7c46713d0ad5e36478a063e This package does not directly contain malicious code, but was uploaded as part of the malicious campaign and is used as a helper in further infection stages. --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in urlssser (PyPI)

Source: kam193 4a59189804dc7b527969a4ed7e4d95fac2b98812c309142270b27cdca47729be This package does not directly contain malicious code, but was uploaded as part of the malicious campaign and is used as a helper in further infection stages. --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in tingetone (PyPI)

Source: kam193 014c881ede6ff27565f1de4842b4f7c10162a2daa47c98a4470188571a60639f Importing the module starts the banner function, which downloads and runs an obfuscated remote script. The package seems to be a clone a one of existing similar packages. --- Category: MALICIOUS - The campaign has...

Malicious code in threadfluent (PyPI)

Source: kam193 2a72da681aea57683d0d6b134f0263f126dfe205810fdcfa970c9920058fcf15 The package contains highly obfuscated content, that install another, downloaded from a remote location obfuscated script in the installation path of the 'requests' package, and marks it as a hidden system file. In...

Malicious code in textgradient (PyPI)

Source: kam193 7fe681cdeb2892cd4e567b4ac8aeb6e0eb22885cce024238e010af54711831ec Highly obfuscated code that during import downloads a remote script with another obfuscated code. The repository with remote script also contains clearly infostealer code --- Category: MALICIOUS - The campaign has...

Malicious code in telebot-infoo (PyPI)

Source: kam193 4a00053312897920b40040788f68a209b63c061000ec349ab3e705675bada499 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in telebot-infee (PyPI)

Source: kam193 660cdc2470d38cf51f0a232119dd9765cba56eb66412f12d3c09b40dd7bd8530 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in tabullates (PyPI)

Source: kam193 499d47c3064299cb3d921b32ac9f22c2bab7b0b841b3de3a0cee3029625d5d26 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tabletas (PyPI)

Source: kam193 27d102f1cf4d0e6b08e5e77aa57a2a436a49f782fe6571b2a8e8d114e10d968d Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tablescene (PyPI)

Source: kam193 75f24eaea6c977e93d35c431f9bedc66b7757fd5c5635425c28801dad3b50de9 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tableapy (PyPI)

Source: kam193 7adeff5bc226723e8e3241a36596e3e99094553770deda5e89ac8caf7c0e0f01 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in tableapys (PyPI)

Source: kam193 2aff2faef3705b6233a6df3d6b39f4f9b88ff522aa7c343cd8d36eb1a40405d6 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...

Malicious code in system-integration (PyPI)

Source: kam193 106aadf74e260c98fb25e21fc8ff5bea93798cc75117200447687debe7f9fba2 When importing the module, code downloads and executes a highly obfuscated remote script. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-01-system-integration...

Malicious code in system-integration-toxi (PyPI)

Source: kam193 096a1a342309a85666ad92b45da1da18ca808e16c93819a3122b2c6bbc2a15d6 During importing the module, code downloads and executes a remote script. During the analysis of this package, the code was a placeholder, but the package is closely related to a previously published one, where the...