Malicious code in cyrptocompare (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e0b280ca1be335923a7f77b62cb936dcbbceedae2ede54fa60e9e5f255fb01c0 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in cryptofed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 12ac1729f8bb663e2bf6a2697a261bb53074fbb0d4196f2cc332cb30cd259ef1 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-1709 Malicious code in crypptofeed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a7d4c83d8dcd9a01f599042126400f7226278c483b07256dcf12847f889fa471 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in freqtradde (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 365f5fc00d47654f001fec8fd784ce03d76e6e2e9e2fed0718087e927fe9d6d9 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious PyPI Packages Drop Malware in New Supply Chain Attack

By Deeba Ahmed These packages were uploaded between the 7th and 12th of January 2023 with the names "colorslib," "httpslib," and "libhttps." This is a post from HackRead.com Read the original post: Malicious PyPI Packages Drop Malware in New Supply Chain Attack...

CVE-2022-23531

CVE-2022-23531 affects GuardDog (CLI to identify malicious PyPI packages). A Relative Path Traversal flaw exists in GuardDog versions prior to 0.1.5 during extraction of .tar.gz packages, allowing an attacker to write arbitrary files on the host when scanning a specially crafted local PyPI packag...

CVE-2022-23531 Arbitrary file write when scanning a specially-crafted local PyPI package

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine...

PYSEC-2022-42993

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destinati...

animl (>=1.1.2 <=1.1.4), audio-classification-models (=1.0.1) +7 more potentially affected by CVE-2022-21740 via tensorflow-gpu (>=2.6.0 <=2.6.2)

tensorflow-gpu PYPI version =2.6.0, =1.1.2, =0.1.5, =0.1.0, =0.9.0, =1.0.5, =1.0.6 Source cves: CVE-2022-21740 Source advisory: OSV:PYSEC-2022-119...

arekit (>=0.21.0 <=0.22.1), arenets (>=0.23.0 <=0.23.1) +169 more potentially affected by CVE-2021-41218 via tensorflow-gpu (>=1.10.1 <=2.4.2)

tensorflow-gpu PYPI version =1.10.1, =0.21.0, =0.23.0, =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =1.0.3 - brainhance =0.0.1 - cctv-analysis =0.0.2 - chatbot-nlu =1.0.0 and more Source cves: CVE-2021-41218 Source advisory: OSV:PYSEC-2021-825...

arekit (>=0.21.0 <=0.22.1), arenets (>=0.23.0 <=0.23.1) +169 more potentially affected by CVE-2021-41198 via tensorflow-gpu (>=1.10.1 <=2.4.2)

tensorflow-gpu PYPI version =1.10.1, =0.21.0, =0.23.0, =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =1.0.3 - brainhance =0.0.1 - cctv-analysis =0.0.2 - chatbot-nlu =1.0.0 and more Source cves: CVE-2021-41198 Source advisory: OSV:PYSEC-2021-806...

aglvq (=1.0.0), beacon-trellis (=0.1.0) +64 more potentially affected by CVE-2020-15209 via tensorflow (=2.1.0)

tensorflow PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - aglvq =1.0.0 - beacon-trellis =0.1.0 - biobb-ml =3.0.0, =0.0.1, =0.2.0, =0.0.2, =0.1.0, =1.1.0, =0.2.0rc1, =0.2.0rc3 and more Source cves:...

arekit (>=0.21.0 <=0.22.1), arenets (>=0.23.0 <=0.23.1) +163 more potentially affected by CVE-2020-15191 via tensorflow-gpu (>=1.10.1 <=2.2.0)

tensorflow-gpu PYPI version =1.10.1, =0.21.0, =0.23.0, =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =1.0.3 - cctv-analysis =0.0.2 - chatbot-nlu =1.0.0 - classitransformers =0.0.1 and more Source cves: CVE-2020-15191 Source advisory: OSV:PYSEC-2020-306...