Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75c59285ee1a5a83447815e7402410ccfca6a287e0c36d61bcfda3d55396f608 Versions published in 2026-07 after the package was removed by the original author and the name was re-registered by another contain a stub 'share compute swar...

pip: pip: Arbitrary file installation via malicious package indexes

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

CVE-2026-13346

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

CVE-2026-59948

A flaw was found in Composer, a dependency manager for the PHP language. A remote attacker could exploit this vulnerability by providing a maliciously crafted package from an untrusted source. During installation or update, Composer's improper validation of package names allows it to write...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 588fed6ec45af5cfb8925b1f7d93b07b73d47b919a50305438153dfbb7f953e1 The malicious code sits in a native module, which is called in a few places, including the code run via PTH embedded since version 1.0.6. The native module...

Malicious Package

Overview @array-util/nodepull is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @array-util/subsearch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview gamified-trading-system is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview font-huge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview tailwind-motionkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview animated-css-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 474db4780bfc49ff2146966bdd508c123baf4d39c636e27aaba1996a0016d8f6 The OpenSSF Package Analysis project identified 'swiperangular' @ 5.9999.0 npm as malicious. It is considered malicious because: - The package...

Malicious Package

Overview -john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection betwe...

Malicious Package

Overview -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, the...

Malicious Package

Overview -pem-misa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanol is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there i...

Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena-espanol is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-suparhit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...