Malicious code in chroma-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...

MAL-2026-16143 Malicious code in chroma-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...

MAL-2026-16142 Malicious code in python-fork (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in python-fork (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its transitive dependencies later receives a vulnerability advisory. Existing vulnerability-detection work often...

MAL-2026-16141 Malicious code in platform-telemetry-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS...

Malicious code in transfomers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3 Package name typosquats the popular transformers library. The distribution installs a .pth file into site-packages, which the Python interpreter...

MAL-2026-16136 Malicious code in transfomers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3 Package name typosquats the popular transformers library. The distribution installs a .pth file into site-packages, which the Python interpreter...

Malicious code in ollamaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11eb7019f9ead481b3c5f203703df3b8b63abab2e03502a02ba30360da9948d9 The ollamaa package on PyPI is a one-character typosquat of ollama. Its init.py re-exports everything from the real ollama package so imports appear ...

MAL-2026-16135 Malicious code in openaii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d982f068d7525c41b811b82cede3710e7b614363abae75c356e6c280412baf The package name 'openaii' is a one-character edit of 'openai' and its PyPI summary copies the official openai project description verbatim 'The...

Malicious code in openaii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d982f068d7525c41b811b82cede3710e7b614363abae75c356e6c280412baf The package name 'openaii' is a one-character edit of 'openai' and its PyPI summary copies the official openai project description verbatim 'The...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-16131 Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-16130 Malicious code in aitextkit-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e96f519e8acba48a6f7760b37a9ad70b94bfbf79fb5eac4fc682849b2837e3 The package presents itself as a small text-cleaning utility library, but both shipped implementation modules text.py and system.py consist of a...

Malicious code in aitextkit-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e96f519e8acba48a6f7760b37a9ad70b94bfbf79fb5eac4fc682849b2837e3 The package presents itself as a small text-cleaning utility library, but both shipped implementation modules text.py and system.py consist of a...

MAL-2026-16128 Malicious code in pymem-win (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package reusing its description, repository URL github.com/srounet/Pymem, and auth...

Malicious code in pymem-win (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package reusing its description, repository URL github.com/srounet/Pymem, and auth...

MAL-2026-16127 Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...

Malicious code in lucy-python-script-2030 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...