Design/Logic Flaw

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805

CVE-2023-45805 affects the Python tool PDM (dependency manager). A crafted pawns-style lockfile in which a project like foo is targeted with foo-2 and a file foo-2-2.tar.gz can mislead PyPI and PDM into installing a different project than what appears in pyproject.toml, potentially allowing arbit...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

MAL-2023-8370 Malicious code in tencent-cloud-python-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security bf236cca18e4d157a57cd3de7abed8ad967103c42b9ae53f5026174af46b64a4 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8362 Malicious code in python-alibabacloud-sdk-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1384f0a4ed6515eb7e720621346f74f53217b73863f4c5e3cda4fc90b52f49e3 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8359 Malicious code in aws-enumerate-iam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 96d7eea455989a7a10bf2fafd9f9c4a2d5d9a4c2a3ec852e424885f3e51c5edb Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8363 Malicious code in python-alibabacloud-tea-openapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8355 Malicious code in alisdkcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 456242a426a17eeaca869a5f00ee2f02d837dec5bba7da9240b6bec77c0ae8a8 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8361 Malicious code in enumerate-iam-aws (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 46f8fde812a7274ad1e270e0cc3a8698349365af5d85ee9b89248fa467e5bf2f Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8310 Malicious code in cephlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f82a5ba62b790856947d686397170162bf743b168fd9d66008ed6501b465d5af The OpenSSF Package Analysis project identified 'cephlib' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8309 Malicious code in xmlbuilder3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5ccc40a08ace658e1c2bb67a692e4a04f1c6c826a6cfbf7c2bec41d0f54c540 The OpenSSF Package Analysis project identified 'xmlbuilder3' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8308 Malicious code in nnabla-ext-cuda101-nccl2-ubuntu16 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 70047d0a5eb542220386cc3c3f7f8bd4bee3faa63ce2124f363abcc1503be3df The OpenSSF Package Analysis project identified 'nnabla-ext-cuda101-nccl2-ubuntu16' @ 0.0.2 pypi as malicious. It is considered malicious becaus...

MAL-2023-8307 Malicious code in narratives-from-tweets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1570135eff60eea1dfd9ec7b66797d9454373263050b83c8ad90d2b7b37d71b6 The OpenSSF Package Analysis project identified 'narratives-from-tweets' @ 0.1 pypi as malicious. It is considered malicious because: - The...

MAL-2023-8306 Malicious code in liblapack-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 01a9f7fec70ee10cd7862c22e2c8257811997655e86e342b7bf61d0bd2b95154 The OpenSSF Package Analysis project identified 'liblapack-dev' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8304 Malicious code in libblas3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce6c63048cc523093131cc1ce9bdc1581093b52f97225581ea78fef61404e8a The OpenSSF Package Analysis project identified 'libblas3' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

Malicious code in libblas3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce6c63048cc523093131cc1ce9bdc1581093b52f97225581ea78fef61404e8a The OpenSSF Package Analysis project identified 'libblas3' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8305 Malicious code in liblapack3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74012077041418bce1aed1339b95d0221435cff33db310194f29d9a0c2451e6e The OpenSSF Package Analysis project identified 'liblapack3' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8570 Malicious code in pyefflorer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9db59fb1fff1df375feb9a17164f004b62a2d5fa194dcc285341536b6bfb51aa Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...