adaptdl-cli (>=0.2.2, <=0.2.11), agent-leash (>=0.3.0, <=0.13.0) +171 more potentially affected by CVE-2026-35536 via tornado (>=6.5.5, <=6.5.7)

tornado PYPI version =6.5.5, =0.2.2, =0.3.0, =0.4.0, =0.2.0, =1.0.0, =0.1.1, =0.2.0, =0.1.0, =0.5.0, =0.1.2, =26.3.14, =26.8.0 - aomaker 2.1.0 and more Source cves: CVE-2026-35536 Source advisory: GHSA-WWV5-G3V4-889X...

acdh-django-vocabs (>=0.1.0, <=0.1.6), acp-calendar (1.6.0) +1179 more potentially affected by CVE-2026-73228 via djangorestframework (>=3.1.1, <=3.17.1)

djangorestframework PYPI version =3.1.1, =0.1.0, =1.1.12, =0.1.0, =0.19.0b3974, =0.0.1, =0.0.3, =2018.3.1, =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.5.0 and more Source cves: CVE-2026-73228 Source advisory: OSV:GHSA-2M8G-3CMR-WG3W...

salmon (0.2.0) potentially affected by CVE-2026-73228 via djangorestframework (2.3.9)

djangorestframework PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - salmon 0.2.0 Source cves: CVE-2026-73228 Source advisory: OSV:GHSA-2M8G-3CMR-WG3W...

wger (1.5.0) potentially affected by CVE-2026-73228 via djangorestframework (2.3.13)

djangorestframework PYPI version 2.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - wger 1.5.0 Source cves: CVE-2026-73228 Source advisory: OSV:GHSA-2M8G-3CMR-WG3W...

acdh-django-vocabs (>=0.1.0, <=0.1.6), acp-calendar (1.6.0) +1179 more potentially affected by CVE-2026-73229 via djangorestframework (>=3.1.1, <=3.17.1)

djangorestframework PYPI version =3.1.1, =0.1.0, =1.1.12, =0.1.0, =0.19.0b3974, =0.0.1, =0.0.3, =2018.3.1, =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.5.0 and more Source cves: CVE-2026-73229 Source advisory: OSV:GHSA-G47C-3XMW-Q6M2...

acdh-django-vocabs (>=0.1.0, <=0.1.6), acp-calendar (1.6.0) +1179 more potentially affected by CVE-2026-73229 via djangorestframework (>=3.1.1, <=3.17.1)

djangorestframework PYPI version =3.1.1, =0.1.0, =1.1.12, =0.1.0, =0.19.0b3974, =0.0.1, =0.0.3, =2018.3.1, =2022.6.0.post0, =2.0.0, =1.0.0, =2.0.0, =2.5.0 and more Source cves: CVE-2026-73229 Source advisory: GHSA-G47C-3XMW-Q6M2...

Malicious Package

Overview gcphelpit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

amzn-nova-customization-sdk (>=1.0.29, <=1.0.83), anymodality (0.1.0) +30 more potentially affected by CVE-2026-83551 via sagemaker (>=1.52.1, <=2.254.1)

sagemaker PYPI version =1.52.1, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.17, =0.1.0, =0.1.1, =0.9.0, =0.2.8, =1.97.0.dev0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.1.2, =0.4.9 and more Source cves: CVE-2026-83551 Source advisory: MEND:CVE-2026-83551...

abnativ (>=1.1.0, <=1.2.9), ai-24sea (>=0.1.0, <=1.1.0) +265 more potentially affected by unknown CVE via mlflow (>=2.1.1, <=3.14.0)

mlflow PYPI version =2.1.1, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =1.7.0.dev1715243074, =1.7.0.dev1715246371, =1.8.0rc6, =1.7.0.dev1715246329, =1.7.0.dev1715246310, =0.1.9, =0.1.40 and more Source cves: unknown CVE Source advisory: OSV:GHSA-GQVG-GMMX-X4HM...

abnativ (>=1.1.0, <=1.2.9), ai-24sea (>=0.1.0, <=1.1.0) +265 more potentially affected by CVE-2026-96775 +1 more via mlflow (>=2.1.1, <=3.14.0)

mlflow PYPI version =2.1.1, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =1.7.0.dev1715243074, =1.7.0.dev1715246371, =1.8.0rc6, =1.7.0.dev1715246329, =1.7.0.dev1715246310, =0.1.9, =0.1.40 and more Source cves: CVE-2026-96775, CVE-2026-96804 Source advisory: SNYK:PYTHON-MLFLOW-19500672...

MAL-2026-15810 Malicious code in gcphelpit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d The module src/gcphelpit/verify.py runs at import time: it reads the installer's /.zshrc and POSTs the raw file contents to the hardcoded endpoint...

Malicious code in gcphelpit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d The module src/gcphelpit/verify.py runs at import time: it reads the installer's /.zshrc and POSTs the raw file contents to the hardcoded endpoint...

nemo-eval (0.2.0rc0) potentially affected by CVE-2026-61778 via megatron-bridge (0.2.0rc6)

megatron-bridge PYPI version 0.2.0rc6 is affected by a known vulnerability. The following packages have a transitive dependency on megatron-bridge and may be impacted: - nemo-eval 0.2.0rc0 Source cves: CVE-2026-61778 Source advisory: MEND:CVE-2026-61778...

nemo-eval (0.2.0rc0) potentially affected by CVE-2026-61779 via megatron-bridge (0.2.0rc6)

megatron-bridge PYPI version 0.2.0rc6 is affected by a known vulnerability. The following packages have a transitive dependency on megatron-bridge and may be impacted: - nemo-eval 0.2.0rc0 Source cves: CVE-2026-61779 Source advisory: MEND:CVE-2026-61779...

nemo-eval (0.2.0rc0) potentially affected by CVE-2026-61754 via megatron-bridge (0.2.0rc6)

megatron-bridge PYPI version 0.2.0rc6 is affected by a known vulnerability. The following packages have a transitive dependency on megatron-bridge and may be impacted: - nemo-eval 0.2.0rc0 Source cves: CVE-2026-61754 Source advisory: MEND:CVE-2026-61754...

a62-emotion (>=0.10.11, <=0.11.4), aac-metrics (>=0.5.5, <=0.6.0) +2520 more potentially affected by CVE-2026-80047 via transformers (>=4.49.0, <=5.8.1)

transformers PYPI version =4.49.0, =0.10.11, =0.5.5, =1.0.0.0, =0.2.1, =0.1.0, =1.3.8, =20260210.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-80047 Source advisory: OSV:GHSA-X9R9-C232-4Q39...

a62-emotion (>=0.10.11, <=0.11.4), aac-metrics (>=0.5.5, <=0.6.0) +2520 more potentially affected by CVE-2026-80047 via transformers (>=4.49.0, <=5.8.1)

transformers PYPI version =4.49.0, =0.10.11, =0.5.5, =1.0.0.0, =0.2.1, =0.1.0, =1.3.8, =20260210.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-80047 Source advisory: GHSA-X9R9-C232-4Q39...

Malicious Package

Overview tallyboxlite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15809 Malicious code in tallyboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 960a6b94c28c7be92373f0f2125106f8e6d0d500a5ca3988292e2bd7e189033c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in tallyboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 960a6b94c28c7be92373f0f2125106f8e6d0d500a5ca3988292e2bd7e189033c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...