MAL-2026-16125 Malicious code in lucy-python-script-2030 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2195ea343abdb1205451fc7c778bdd1580cf985461949081852e9e82363ac389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Compromise of PyTorch Lightning PyPi Package Versions

Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions Published: 2026-04-30 Last Updated: 2026-05-12 Github Advisory: CVE-2026-44484We have identified a security incident affecting certain versions of one of our PyPI packages. What happenedWe have determined that one or more...

PYSEC-2026-3973 Compromise of PyTorch Lightning PyPi Package Versions

Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions Published: 2026-04-30 Last Updated: 2026-05-12 Github Advisory: CVE-2026-44484 We have identified a security incident affecting certain versions of one of our PyPI packages. What happened We have determined that one or more...

ROOT-APP-PYPI-CVE-2026-41205 CVE-2026-41205 in mako - Patched by Root

Root has patched CVE-2026-41205 in the mako package for Root:PyPI. Multiple fixed versions available...

MAL-2026-16122 Malicious code in pylever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6720ca3891de59548dfdfc9b6af778b5bf97fb31c5188381c73e92c4ac2820e1 The package's Client class scans Chrome, Edge, and Brave browser profile LevelDB and Cache directories and the Discord Desktop app's Roaming/discord...

Malicious code in pylever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6720ca3891de59548dfdfc9b6af778b5bf97fb31c5188381c73e92c4ac2820e1 The package's Client class scans Chrome, Edge, and Brave browser profile LevelDB and Cache directories and the Discord Desktop app's Roaming/discord...

Malicious Package

Overview bq-build-probe-vrp-2026 is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

Malicious Package

Overview bq-sdist-probe-vrp is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

Malicious Package

Overview websetup is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the websetup package...

Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

MAL-2026-16098 Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

agentengine-sdk-python (>=0.2.0, <=0.4.0), agentic-chat-ui (>=0.1.0, <=0.2.4) +47 more potentially affected by CVE-2026-86099 via chainlit (>=1.0.0, <=2.12.0)

chainlit PYPI version =1.0.0, =0.2.0, =0.1.0, =0.3.0, =0.0.3, =0.14.0, =0.0.0, =0.1.1, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.0.2, =0.2.13 - context-protector 1.0.0 and more Source cves: CVE-2026-86099 Source advisory: SNYK:PYTHON-CHAINLIT-19659988...

MAL-2026-16121 Malicious code in websetup (PyPI)

[email protected] is a single module whose only function, setup.settext=None, filepath=None in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook id 1546817174411288617; the name Discord returns for it is "backdoor" and swallows every...

Malicious code in websetup (PyPI)

[email protected] is a single module whose only function, setup.settext=None, filepath=None in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook id 1546817174411288617; the name Discord returns for it is "backdoor" and swallows every...

Malicious code in databricks-webapp-navigation-homepage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 31ec3549efe09642c539f13af8a2a75949a356f55046b6298c21a2deedda322c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-16080 Malicious code in databricks-webapp-navigation-homepage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 31ec3549efe09642c539f13af8a2a75949a356f55046b6298c21a2deedda322c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious Package

Overview databricks-webapp-navigation-homepage is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all...

Malicious Package

Overview py-devoli-common is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...

a2 (>=0.1.0, <=0.3.17), abadpour (>=6.13.1, <=7.24.1) +978 more potentially affected by CVE-2026-79721 via mlflow (>=0.8.2, <=3.16.1)

mlflow PYPI version =0.8.2, =0.1.0, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.0.5, =1.0.0, =0.1.0, =0.1.42, =0.1.44 - aidevelopementtoolkit 0.2.0 and more Source cves: CVE-2026-79721 Source advisory: SNYK:PYTHON-MLFLOW-19653590...

MAL-2026-16017 Malicious code in telegram-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90afeb1d39f1ef3d107f2da6a26c4af8c7efb314bb0f272d45fa755119e1b669 telegramhelper describes itself as "A minimal example Python library" and ships a Russian-language template README the Homepage field is still the...