CVE-2022-34509

The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party...

CVE-2022-44053

The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0...

MAL-2025-3741 Malicious code in dial-xl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 129b71dc44955e560cd56ff53e0be19aced751699016fa96cb04ee75d2e76e3b Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

Malicious code in dial-xl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 129b71dc44955e560cd56ff53e0be19aced751699016fa96cb04ee75d2e76e3b Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

MAL-2025-3744 Malicious code in program-admin (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 79810d0cd56c8a3266dcbe5827dd3d27eb976b353c7b17940a29dddc602df4f7 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

MAL-2025-4254 Malicious code in veriftest1asdlaaaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 18d30d48c72a61cda2e8b0ecd3a27b958e8964b4c65833cb780186382285101d During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-4251 Malicious code in veriftest1asdla (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e04795c3a8f7fae13a125bde307aa64db04ae9f4ff76bd1d11fb32b4d3f57a36 During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in testveriftest1asdlaaaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b241cae62c005e3cd31a8251941ab101ebcca75aa4c8cb988905e87529339cd During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3602 Malicious code in testveriftest1asdlaaaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b241cae62c005e3cd31a8251941ab101ebcca75aa4c8cb988905e87529339cd During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-4252 Malicious code in veriftest1asdlaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84fe70a8f5e34c8334d7284bcc9b71826210f029708a53a6ec4b9bb90a33054b During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3481 Malicious code in web3rpc (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3445 Malicious code in evm-validator (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3020 Malicious code in ytest-cov (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2990 Malicious code in pyroforktgcrypto-pyrofork (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2927 Malicious code in 7-0 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +47 more potentially affected by CVE-2024-8487 via agentscope (>=0.1.0, <=2.0.7.post1)

agentscope PYPI version =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.2.0, =0.1.5, =2.1.0, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.0.2 and more Source cves: CVE-2024-8487 Source advisory: SNYK:PYTHON-AGENTSCOPE-9511372...

classy-imaginary (>=0.4.8, <=0.6.5) potentially affected by CVE-2024-12761 via imaginairy (>=10.0.1, <=11.1.0)

imaginairy PYPI version =10.0.1, =0.4.8, =0.6.5 Source cves: CVE-2024-12761 Source advisory: SNYK:PYTHON-IMAGINAIRY-9689918...

MAL-2025-2592 Malicious code in blackspammerbd-tg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 899ac6c3d1b62da3553aab693790598d0e87f6530b57d335deaee2545a39eb9c This package seems to be part of a larger malicious toolkit designed for unauthorized access to systems, data theft, and potentially acting as a...

MAL-2025-3439 Malicious code in ccxt-mexc-futures (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f2eb5eb75679b536c430ad6d5440e63fbe1d1cd391ab1abf2a411dae3a768ed8 There is a hidden code that overwrites the default method and downloads remote data, which contains the dictionary pretending to be the right value, and a hidd...

This Malicious PyPI Package Stole Ethereum Private Keys via Polygon RPC Transactions

Cybersecurity researchers have discovered a malicious Python package on the Python Package Index PyPI repository that's equipped to steal a victim's Ethereum private keys by impersonating popular libraries. The package in question is set-utils, which has received 1,077 downloads to date. It's no...