A single post-release of dydx-v4-client contained obfuscated multi-stage loader

A PyPI user account compromised by an attacker and was able toupload a malicious version 1.1.5.post1 of the dydx-v4-client package.This version contains a highly obfuscated multi-stage loaderthat ultimately executes malicious code on the host system.While the final payload is not visible because ...

Malicious code in morty-package (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d87e4d2c5f3096d67a98e166e70ed6d4288c7d7554852e8d14bb60213f9a574b Package presents an extremely deep obfuscation of a code that is imported during installation. The exact behavior is unknown, but it includes loading encrypted...

Malicious code in pypi-package-explore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 54257ec88b5f7a5bd69177f84a4c396ab208e727ba1c7b079056f1fab2705c37 Package presents an extremely deep obfuscation of a code that is imported during installation. The exact behavior is unknown, but it includes loading encrypted...

PT-2026-8379

A PyPI user account compromised by an attacker and was able to upload a malicious version 1.1.5.post1 of the dydx-v4-client package. This version contains a highly obfuscated multi-stage loader that ultimately executes malicious code on the host system. While the final payload is not visible...

Malicious code in system-integration-toxi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 096a1a342309a85666ad92b45da1da18ca808e16c93819a3122b2c6bbc2a15d6 During importing the module, code downloads and executes a remote script. During the analysis of this package, the code was a placeholder, but the package is...

MAL-2026-469 Malicious code in cflashfiles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d8c5174968b7dedf000076201fe6446018aa61048b6a77fc8bc42e16bb796fd9 Malicious clone of legitimate fsspec package. The code was modified to exfiltrate specific files on import. --- Category: MALICIOUS - The campaign has clearly...

io4it (>=2.0.0, <=3.0.4.1), leettools (>=1.0.14, <=1.0.17) potentially affected by CVE-2020-14343 +1 more via docling-core (>=2.21.1, <=2.26.3)

docling-core PYPI version =2.21.1, =2.0.0, =1.0.14, =1.0.17 Source cves: CVE-2020-14343, CVE-2026-24009 Source advisory: SNYK:PYTHON-DOCLINGCORE-15091522...

Malicious code in sympy-dev (PyPI)

Package downloads and executes code from remote servers, indicating malicious behavior. Multiple files and IPs involved. Package impersonates popular sympy package...

EUVD-2026-3707

Malicious code in anduril-lattice-sdk-grpc-python PyPI...

shynabot (0.0.1), shynataskmanager (0.0.1) potentially affected by CVE-2026-23842 via chatterbot (1.0.4)

chatterbot PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on chatterbot and may be impacted: - shynabot 0.0.1 - shynataskmanager 0.0.1 Source cves: CVE-2026-23842 Source advisory: OSV:GHSA-V4W8-49PV-MF72...

shynabot (0.0.1), shynataskmanager (0.0.1) potentially affected by CVE-2026-23842 via chatterbot (1.0.4)

chatterbot PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on chatterbot and may be impacted: - shynabot 0.0.1 - shynataskmanager 0.0.1 Source cves: CVE-2026-23842 Source advisory: GHSA-V4W8-49PV-MF72...

agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2026-22219 via chainlit (>=2.4.400, <=2.6.3)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-22219 Source advisory: GHSA-2G59-M95P-PGFQ...

agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2026-22219 via chainlit (>=2.4.400, <=2.6.3)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-22219 Source advisory: OSV:GHSA-2G59-M95P-PGFQ...

dictatorgenai (0.1.0), lit-data-layers (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-22218 via chainlit (1.3.2)

chainlit PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - dictatorgenai 0.1.0 - lit-data-layers =0.1.0, =0.1.4 Source cves: CVE-2026-22218 Source advisory: OSV:PYSEC-2026-598...

agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2026-22218 via chainlit (>=2.4.400, <=2.6.3)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-22218 Source advisory: OSV:PYSEC-2026-598...

edubotics-core (>=0.1.3, <=0.1.7) potentially affected by CVE-2026-22218 via chainlit (1.2.0)

chainlit PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - edubotics-core =0.1.3, =0.1.7 Source cves: CVE-2026-22218 Source advisory: OSV:PYSEC-2026-598...

CVE-2025-56005: Deserialization of Untrusted Data

An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in the yacc function. This parameter accepts a .pkl file that is deserialized with pickle.load without validation. Because pickle allows execution of embedded...

CVE-2025-56005

An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in the yacc function. This parameter accepts a .pkl file that is deserialized with pickle.load without validation. Because pickle allows execution of embedded...

Malicious code in medifile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c005d95a9b1b91118e9306168ce69163190184714fe53c65b7ba716e867c8da Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

akasha-terminal (>=0.8.0, <=0.8.72), auralis (>=0.1.0, <=0.2.7) +17 more potentially affected by CVE-2025-15536 via opencc (>=1.1.1, <=1.1.9)

opencc PYPI version =1.1.1, =0.8.0, =0.1.0, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.2 - senti-c 0.0.4 and more Source cves: CVE-2025-15536 Source advisory: SNYK:PYTHON-OPENCC-15874419...