11220 matches found
MAL-2026-16475 Malicious code in memoryos (PyPI)
On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...
MAL-2026-16421 Malicious code in kerokwis (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Malicious code in kerokwis (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The payload does not run at install time, but upon invocation of the package. A language-specific loader then...
Embedded Malicious Code
Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...
Malicious code in auclean (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...
GHSA-5WF4-JQXH-8GM3 mcp-atlassian has an incomplete SSRF remediation
Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...
Malicious code in snap-queue (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bb29642def9150e89bacf4da4e1a64f7bc972cd145053cbb0feee0baa768f3 The sdist's setup.py defines a wusboot function that is invoked at module top-level before setup..., so it runs automatically on pip install...
MAL-2026-16408 Malicious code in snap-queue (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bb29642def9150e89bacf4da4e1a64f7bc972cd145053cbb0feee0baa768f3 The sdist's setup.py defines a wusboot function that is invoked at module top-level before setup..., so it runs automatically on pip install...
Malicious code in poly-check-b (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...
MAL-2026-16407 Malicious code in poly-check-b (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...
MAL-2026-16406 Malicious code in crypto-trader-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e855a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c The package presents itself as a crypto trading and backtesting toolkit, but ships no library code matching that description — SOURCES.txt lists only...
Malicious code in crypto-trader-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e855a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c The package presents itself as a crypto trading and backtesting toolkit, but ships no library code matching that description — SOURCES.txt lists only...
ROOT-APP-PYPI-GHSA-JM78-9FVV-MHGR GHSA-jm78-9fvv-mhgr in GitPython - Patched by Root
Root has patched GHSA-jm78-9fvv-mhgr in the GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-2F96-G7MH-G2HX GHSA-2f96-g7mh-g2hx in GitPython - Patched by Root
Root has patched GHSA-2f96-g7mh-g2hx in the GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-89FF-M8WV-P99R GHSA-89ff-m8wv-p99r in GitPython - Patched by Root
Root has patched GHSA-89ff-m8wv-p99r in the GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-44244 CVE-2026-44244 in GitPython - Patched by Root
Root has patched CVE-2026-44244 in the GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-6P8H-3WGX-97GF GHSA-6p8h-3wgx-97gf in GitPython - Patched by Root
Root has patched GHSA-6p8h-3wgx-97gf in the GitPython package for Root:PyPI. Multiple fixed versions available...