llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)

starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: GHSA-6753-GR46-6WPR...

Malicious Package

Overview trongridet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview pybitjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

aa-rag (>=0.4.2, <=0.4.3), aaa-ml-datasets-course (1.0.0) +929 more potentially affected by CVE-2026-80206 via nltk (>=3.0.0, <=3.10.2)

nltk PYPI version =3.0.0, =0.4.2, =0.2.3, =0.0.1, =0.2.0, =0.0.4, =0.4.0, =0.0.1, =0.1.0, =1.1.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-80206 Source advisory: OSV:PYSEC-2026-3751...

annotald (>=1.3.1, <=1.3.7) potentially affected by CVE-2026-80205 via nltk (2.0.4)

nltk PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald =1.3.1, =1.3.7 Source cves: CVE-2026-80205 Source advisory: OSV:PYSEC-2026-3750...

annotald (1.3.8), caterpillar (>=1.0.0.dev4, <=1.0.0.dev17) potentially affected by CVE-2026-80205 via nltk (2.0.5)

nltk PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald 1.3.8 - caterpillar =1.0.0.dev4, =1.0.0.dev17 Source cves: CVE-2026-80205 Source advisory: OSV:PYSEC-2026-3750...

Malicious code in 0xfighter3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14525 Malicious code in 0xfighter3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in bigquery-agent-analytics-tracing (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 08fbff35384a45aedc39545dd2a174889a1c35f3e6c9d044c2c201905402ad99 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14524 Malicious code in bigquery-agent-analytics-tracing (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 08fbff35384a45aedc39545dd2a174889a1c35f3e6c9d044c2c201905402ad99 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in rce-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c27b8e593dc0298e09bb4a5fd6acc68dc03bf324bdc7267e87482fdd10b0fa2d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14523 Malicious code in rce-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c27b8e593dc0298e09bb4a5fd6acc68dc03bf324bdc7267e87482fdd10b0fa2d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14522 Malicious code in syntaxerror-package-12345 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ede434cf61641064a49939821778e511c3fcf8afab7e443582b8b103e13171d9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in syntaxerror-package-12345 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ede434cf61641064a49939821778e511c3fcf8afab7e443582b8b103e13171d9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

PT-2026-86430

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

dyad (0.1.1), dyad-app (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-77357 via mesop (1.0.0rc1)

mesop PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mesop and may be impacted: - dyad 0.1.1 - dyad-app =0.1.0, =0.1.2 Source cves: CVE-2026-77357 Source advisory: MEND:CVE-2026-77357...

agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +6 more potentially affected by CVE-2026-45018 via chainlit (>=2.4.400, <=2.11.1)

chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.2.2, =0.7.5, =0.7.10 Source cves: CVE-2026-45018 Source advisory: SNYK:PYTHON-CHAINLIT-19268250...

jhub-shibboleth-auth (1.3.0) potentially affected by CVE-2026-54338 via jupyterhub (0.9.2)

jupyterhub PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.3.0 Source cves: CVE-2026-54338 Source advisory: OSV:GHSA-P43P-WHWX-Q52H...

jhub-shibboleth-auth (1.4.0) potentially affected by CVE-2026-54338 via jupyterhub (0.9.4)

jupyterhub PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.4.0 Source cves: CVE-2026-54338 Source advisory: OSV:GHSA-P43P-WHWX-Q52H...

jhub-shibboleth-auth (1.0.0) potentially affected by CVE-2026-54338 via jupyterhub (0.8.1)

jupyterhub PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.0.0 Source cves: CVE-2026-54338 Source advisory: OSV:GHSA-P43P-WHWX-Q52H...