dev-tools-eagle (>=0.9.0, <=0.9.4) potentially affected by CVE-2026-55253 via langgraph-store-mongodb (0.1.1)

langgraph-store-mongodb PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-store-mongodb and may be impacted: - dev-tools-eagle =0.9.0, =0.9.4 Source cves: CVE-2026-55253 Source advisory: GHSA-533J-2V4Q-MW5H...

ai-sec (>=0.0.1, <=0.0.9), awslabs-ccapi-mcp-server (>=1.0.1, <=1.0.18) +54 more potentially affected by CVE-2026-55244 via asteval (>=1.0.5, <=1.0.8)

asteval PYPI version =1.0.5, =0.0.1, =1.0.1, =0.0.1, =1.0.254, =2.4.22, =3.2.415, =1.0.0, =0.1.130, =6.0.0, =0.1.0, =0.1.1, =0.1.0, =0.1.6.dev8, =0.1.6.dev40 and more Source cves: CVE-2026-55244 Source advisory: SNYK:PYTHON-ASTEVAL-19233313...

ai-sec (>=0.0.1, <=0.0.9), awslabs-ccapi-mcp-server (>=1.0.1, <=1.0.18) +54 more potentially affected by CVE-2026-55244 via asteval (>=1.0.5, <=1.0.8)

asteval PYPI version =1.0.5, =0.0.1, =1.0.1, =0.0.1, =1.0.254, =2.4.22, =3.2.415, =1.0.0, =0.1.130, =6.0.0, =0.1.0, =0.1.1, =0.1.0, =0.1.6.dev8, =0.1.6.dev40 and more Source cves: CVE-2026-55244 Source advisory: OSV:GHSA-89V8-RHWQ-HF77...

resolwe (>=30.0.0a1, <=35.2.0a1), resolwe-bio (>=44.0.0a1, <=52.1.0) potentially affected by CVE-2026-55244 via asteval (0.9.26)

asteval PYPI version 0.9.26 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - resolwe =30.0.0a1, =44.0.0a1, =52.1.0 Source cves: CVE-2026-55244 Source advisory: OSV:GHSA-89V8-RHWQ-HF77...

ai-sec (>=0.0.1, <=0.0.9), awslabs-ccapi-mcp-server (>=1.0.1, <=1.0.18) +54 more potentially affected by CVE-2026-102734 via asteval (>=1.0.5, <=1.0.8)

asteval PYPI version =1.0.5, =0.0.1, =1.0.1, =0.0.1, =1.0.254, =2.4.22, =3.2.415, =1.0.0, =0.1.130, =6.0.0, =0.1.0, =0.1.1, =0.1.0, =0.1.6.dev8, =0.1.6.dev40 and more Source cves: CVE-2026-102734 Source advisory: OSV:GHSA-9W56-46F6-3QHX...

resolwe (>=36.0.0a1, <=40.0.0), resolwe-bio (>=0.0.0, <=57.0.1) potentially affected by CVE-2026-102734 via asteval (0.9.29)

asteval PYPI version 0.9.29 is affected by a known vulnerability. The following packages have a transitive dependency on asteval and may be impacted: - resolwe =36.0.0a1, =0.0.0, =57.0.1 Source cves: CVE-2026-102734 Source advisory: OSV:GHSA-9W56-46F6-3QHX...

deep-rehab-pile (0.1.3), heavyedge-classify (>=1.0.0, <=1.1.1) potentially affected by CVE-2026-18285 via aeon (>=1.3.0, <=1.4.0)

aeon PYPI version =1.3.0, =1.0.0, =1.1.1 Source cves: CVE-2026-18285 Source advisory: MEND:CVE-2026-18285...

Malicious code in rc4-secure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt invokes...

MAL-2026-14306 Malicious code in rc4-secure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt invokes...

agentiacap (>=0.1.2, <=0.1.10), agntrick-whatsapp (>=0.2.0, <=0.3.7) +89 more potentially affected by CVE-2026-55236 via langgraph-api (>=0.0.22, <=0.9.1)

langgraph-api PYPI version =0.0.22, =0.1.2, =0.2.0, =0.0.1, =0.1.1, =0.1.4, =0.1.3, =1.0.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0b1, =0.1.24rc7, =0.1.2, =0.1.32 - universal-mcp-ahrefs 0.1.1 and more Source cves: CVE-2026-55236 Source advisory: OSV:GHSA-JFJ5-WRJ9-63X4...

agentiacap (>=0.1.2, <=0.1.10), agntrick-whatsapp (>=0.2.0, <=0.3.7) +89 more potentially affected by CVE-2026-55235 via langgraph-api (>=0.0.22, <=0.9.1)

langgraph-api PYPI version =0.0.22, =0.1.2, =0.2.0, =0.0.1, =0.1.1, =0.1.4, =0.1.3, =1.0.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0b1, =0.1.24rc7, =0.1.2, =0.1.32 - universal-mcp-ahrefs 0.1.1 and more Source cves: CVE-2026-55235 Source advisory: GHSA-2C9Q-C2Q9-QGQV...

Malicious Package

Overview reqcrypt-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview rc4-secure is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview libasync is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview infogram-bot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview socks5901 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview deepface-weight is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview httpz-requests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview reqcrypt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview deepface-weights is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...