Malicious code in pylever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6720ca3891de59548dfdfc9b6af778b5bf97fb31c5188381c73e92c4ac2820e1 The package's Client class scans Chrome, Edge, and Brave browser profile LevelDB and Cache directories and the Discord Desktop app's Roaming/discord...

MAL-2026-16122 Malicious code in pylever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6720ca3891de59548dfdfc9b6af778b5bf97fb31c5188381c73e92c4ac2820e1 The package's Client class scans Chrome, Edge, and Brave browser profile LevelDB and Cache directories and the Discord Desktop app's Roaming/discord...

Malicious Package

Overview bq-sdist-probe-vrp is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

Malicious Package

Overview websetup is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the websetup package...

Malicious Package

Overview bq-build-probe-vrp-2026 is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-88001 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-88001 Source advisory: OSV:GHSA-5X7X-4C3C-QF5W...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-88002 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-88002 Source advisory: SNYK:PYTHON-OPENWEBUI-20158686...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-88002 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-88002 Source advisory: GHSA-JQHH-CJMQ-VMV6...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-88002 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-88002 Source advisory: MEND:CVE-2026-88002...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-87999 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-87999 Source advisory: MEND:CVE-2026-87999...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87016 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87016 Source advisory: MEND:CVE-2026-87016...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87015 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87015 Source advisory: MEND:CVE-2026-87015...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87014 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87014 Source advisory: MEND:CVE-2026-87014...

hubzoid (>=0.7.15, <=0.9.6) potentially affected by CVE-2026-87013 via open-webui (0.11.0)

open-webui PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - hubzoid =0.7.15, =0.9.6 Source cves: CVE-2026-87013 Source advisory: MEND:CVE-2026-87013...

Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

MAL-2026-16098 Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

brs-xss (4.0.0), complio (0.1.2) +14 more potentially affected by CVE-2026-55073 via weasyprint (60.2.0)

weasyprint PYPI version 60.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - brs-xss 4.0.0 - complio 0.1.2 - gendazpack 0.1.0 - investments 0.2.0 - invocr =1.0.0, =0.1.0, =0.1.4.29, =0.1.0, =0.1.10, =21.8.0, =0.1.0,...

ai-parrot (>=0.5.0, <=0.5.16), aleksis-app-order (>=0.1.1, <=0.7.0.dev0) +11 more potentially affected by CVE-2026-55073 via weasyprint (61.2.0)

weasyprint PYPI version 61.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - ai-parrot =0.5.0, =0.1.1, =1.0.0, =0.1.1, =3.3.0, =0.9.8, =21.9.1, =1.0.1, =3.12.27, =2.8.0, =2.10.1 - xblock-ai-eval 0.3.3 Source cves:...

alertwise (1.0.0), md2weasypdf (>=0.0.39, <=0.0.44) +1 more potentially affected by CVE-2026-55073 via weasyprint (63.0.0)

weasyprint PYPI version 63.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - alertwise 1.0.0 - md2weasypdf =0.0.39, =0.0.44 - sampledb 0.30.0 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

roc-punk (>=0.2.3, <=0.2.9) potentially affected by CVE-2026-55073 via weasyprint (0.28.0)

weasyprint PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - roc-punk =0.2.3, =0.2.9 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...