Malicious code in flask-header-guard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8 The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the librar...

battlehack20 (>=1.0.0, <=1.1.0), battlehack20-fancyviewer (>=1.0.1, <=1.0.5) potentially affected by CVE-2026-55830 via restrictedpython (4.0.0b4)

restrictedpython PYPI version 4.0.0b4 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - battlehack20 =1.0.0, =1.0.1, =1.0.5 Source cves: CVE-2026-55830 Source advisory: OSV:GHSA-FFG3-P8FM-MJX2...

agora-protocol (0.2.0), athina (>=1.6.24, <=1.6.33) +14 more potentially affected by CVE-2026-55830 via restrictedpython (7.4.0)

restrictedpython PYPI version 7.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - agora-protocol 0.2.0 - athina =1.6.24, =0.1.5, =0.1.0, =0.38.0, =0.0.86, =0.0.43a23, =0.1.24, =0.2.0, =0.2.0, =0.3.2 and more...

dimensigon (>=0.3.4, <=0.3.5) potentially affected by CVE-2026-55830 via restrictedpython (5.1.0)

restrictedpython PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - dimensigon =0.3.4, =0.3.5 Source cves: CVE-2026-55830 Source advisory: OSV:GHSA-FFG3-P8FM-MJX2...

dothttp-req (>=0.0.43a14, <=0.0.43a17), dynamiq (>=0.5.2, <=0.11.1) potentially affected by CVE-2026-55830 via restrictedpython (7.1.0)

restrictedpython PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - dothttp-req =0.0.43a14, =0.5.2, =0.11.1 Source cves: CVE-2026-55830 Source advisory: OSV:GHSA-FFG3-P8FM-MJX2...

dektools (>=0.1.0, <=0.1.117), dothttp-req (>=0.0.41a1, <=0.0.42a1) potentially affected by CVE-2026-55830 via restrictedpython (5.2.0)

restrictedpython PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - dektools =0.1.0, =0.0.41a1, =0.0.42a1 Source cves: CVE-2026-55830 Source advisory: OSV:GHSA-FFG3-P8FM-MJX2...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-55247 via plone-app-event (4.0.0a9)

plone-app-event PYPI version 4.0.0a9 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-event and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-55247 Source advisory: OSV:GHSA-R82H-MQW3-FC56...

weblate-fedora-messaging (0.10.0), wlhosted (2024.11.0) potentially affected by CVE-2026-55228 via weblate (5.13.3)

weblate PYPI version 5.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on weblate and may be impacted: - weblate-fedora-messaging 0.10.0 - wlhosted 2024.11.0 Source cves: CVE-2026-55228 Source advisory: OSV:GHSA-2Q2Q-JR9G-V9RF...

wlhosted (2025.1.0) potentially affected by CVE-2026-55228 via weblate (5.16.2)

weblate PYPI version 5.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on weblate and may be impacted: - wlhosted 2025.1.0 Source cves: CVE-2026-55228 Source advisory: OSV:GHSA-2Q2Q-JR9G-V9RF...

weblate-fedora-messaging (0.10.0), wlhosted (2024.11.0) potentially affected by CVE-2026-55227 via weblate (5.13.3)

weblate PYPI version 5.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on weblate and may be impacted: - weblate-fedora-messaging 0.10.0 - wlhosted 2024.11.0 Source cves: CVE-2026-55227 Source advisory: OSV:GHSA-2P9G-X3CV-5HH4...

plone-app-z3cform (>=4.0.0a1, <=4.0.0a10) potentially affected by CVE-2026-55248 via plone-app-portlets (4.4.0)

plone-app-portlets PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: CVE-2026-55248 Source advisory: OSV:GHSA-X5G3-W747-2H8Q...

plone-app-layout (>=4.0.0a1, <=4.0.0a4) potentially affected by CVE-2026-55248 via plone-app-portlets (5.0.2)

plone-app-portlets PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-portlets and may be impacted: - plone-app-layout =4.0.0a1, =4.0.0a4 Source cves: CVE-2026-55248 Source advisory: OSV:GHSA-X5G3-W747-2H8Q...

Malicious code in calcboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 227fe04d85516bd5348dea2c0c25078d057eacb4f439fd6a241ea0409b7afd09 setup.py and calcboxlite/init.py both invoke a top-level report function that reads getpass.getuser and socket.gethostname and POSTs them as JSON to ...

MAL-2026-15488 Malicious code in calcboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 227fe04d85516bd5348dea2c0c25078d057eacb4f439fd6a241ea0409b7afd09 setup.py and calcboxlite/init.py both invoke a top-level report function that reads getpass.getuser and socket.gethostname and POSTs them as JSON to ...

Malicious code in yamlformat-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-14589 Malicious code in yamlformat-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-14590 Malicious code in yamlformatter-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in yamlformatter-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...