MAL-2023-6813 Malicious code in strgrand (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a4b40b9603031e60658877c559a4c1d363bdcaa4fe74b5ecf3690279267130a2 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4795 Malicious code in nvidiapep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8da378cd3fac6979191e232010afc6034959a33da3ad5ca8aac222d60d71a4cd EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5812 Malicious code in pywint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 60244f467b54cd58b4ea92ae68470643d2680e41b22a9853531a8c8a9e0fff72 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in ramcontrol (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d677c89ce6ac3c350190e502e42448cb39cf24bc53736ebb0107f3fa6174139b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in visacraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1e617d2eef18ffb90edf647fa39ef7fd338d584d7087126098d1c3b39faea195 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in pywpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4b515a97de9b02263358313b22241bfee6e523c4bd8d0deb8bb9f3d5c2ecc98a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in infohttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4f807b0eb52d14caa4416d401a6f62c95fb520545ddd4c4f79987799f6857955 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in superhttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4530f70b19e8b2467cb6e378d3b79ac0d896dd937953b4752124cdccd84f657f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in postget (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx de7e1b853978f87531b6eb0dfe9b5e1337999d82badf65433f565377626c7763 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in getvm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1893226af4cb26683b8fcda6c43db839ac1be30accde3a7b0a39841aa80c6396 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in ramram (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 539b98584e81afaf0e9e93ea0f969b32a16595957127bfbe7f1a8d7b5a422081 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in beauitfulsoup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a3aade995adaf254f40c4e6c38179161529ba6b90fc15731e6258a1f5a1ef0a2 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

CVE-2022-23531 Arbitrary file write when scanning a specially-crafted local PyPI package

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine...

CVE-2022-23531 Arbitrary file write when scanning a specially-crafted local PyPI package

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine...

CVE-2022-23530

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destinati...

PYSEC-2022-42993

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destinati...

CVE-2022-23530 GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destinati...

GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

Summary Unsafe extracting using shutil.unpackarchive from a remotely retrieved tarball may lead to writing the extracted file to an unintended destination. Details Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destination file path is...

Design/Logic Flaw

An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented getfiletransfertype method...

CVE-2022-42964

An exponential ReDoS Regular Expression Denial of Service can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.fromstring method...