MAL-2026-13728 Malicious code in dlmm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 044faa804b628c1751f6fa5f66a5f8835ecda1f4d2837ae70411d4630a0607ad Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in dlmm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 044faa804b628c1751f6fa5f66a5f8835ecda1f4d2837ae70411d4630a0607ad Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

ai-vocabulary-builder (>=0.8.0, <=1.4.3), pdm (>=2.0.0a1, <=2.0.0b1) potentially affected by CVE-2026-73030 via unearth (>=0.4.1, <=0.17.5)

unearth PYPI version =0.4.1, =0.8.0, =2.0.0a1, =2.0.0b1 Source cves: CVE-2026-73030 Source advisory: SNYK:PYTHON-UNEARTH-18610067...

agilerl (>=2.4.2.dev0, <=2.7.0), ai2-catwalk (0.2.2) +213 more potentially affected by CVE-2026-69112 via accelerate (>=1.0.1, <=1.14.0)

accelerate PYPI version =1.0.1, =2.4.2.dev0, =0.1.8, =3.1.8, =0.0.0, =0.1.0rc3, =1.0.0, =3.1.0, =3.9.11, =0.6.0, =0.1.0, =0.3.0, =0.8.26, =0.5.0, =0.19.0 and more Source cves: CVE-2026-69112 Source advisory: GHSA-4J2P-28Q2-5M79...

simpletrainer (>=0.1.0, <=0.3.2.post2), spadepp (>=0.1.2, <=0.1.5) potentially affected by CVE-2026-69112 via accelerate (0.12.0)

accelerate PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - simpletrainer =0.1.0, =0.1.2, =0.1.5 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

alpaca-farm (>=0.1.10, <=0.2.0) potentially affected by CVE-2026-69112 via accelerate (0.20.0)

accelerate PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - alpaca-farm =0.1.10, =0.2.0 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

textrpp-py (0.1.0) potentially affected by CVE-2026-69112 via accelerate (0.26.0)

accelerate PYPI version 0.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - textrpp-py 0.1.0 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

africanwhisper (0.2.1), autotrain-advanced (>=0.7.8, <=0.7.15) +16 more potentially affected by CVE-2026-69112 via accelerate (0.27.2)

accelerate PYPI version 0.27.2 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - africanwhisper 0.2.1 - autotrain-advanced =0.7.8, =0.0.5, =0.1.4, =0.2.0, =0.0.0, =3.7.0, =0.0.2, =0.0.5, =1.10.2, =0.0.0, =0.6.6, =0.6.9 a...

autotrain-advanced (>=0.7.45, <=0.7.52), translation-canvas (>=0.0.0, <=1.0.2) potentially affected by CVE-2026-69112 via accelerate (0.29.1)

accelerate PYPI version 0.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - autotrain-advanced =0.7.45, =0.0.0, =1.0.2 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

aiforthechurch (>=0.1.0, <=0.5.0), alignment-handbook (>=0.1.0, <=0.2.0) +19 more potentially affected by CVE-2026-69112 via accelerate (0.23.0)

accelerate PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - aiforthechurch =0.1.0, =0.1.0, =1.0.0, =0.1.66, =2.3.0, =0.0.1a2, =3.2.0, =0.1.1, =0.1.3, =0.0.2, =0.1.0, =0.2.1 and more Source cves:...

aana (>=0.2.1, <=0.2.2.2), aegis-web3-cli (0.0.2) +19 more potentially affected by CVE-2026-69112 via accelerate (0.26.1)

accelerate PYPI version 0.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - aana =0.2.1, =0.6.82, =0.1.0, =0.1.2, =0.1.0, =0.0.2rc0, =3.6.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.0.8, =0.0.10 - logits-processor-zoo 0.1...

a2 (>=0.10.5, <=0.10.13), africanwhisper (>=0.2.3, <=0.9.0) +17 more potentially affected by CVE-2026-69112 via accelerate (0.28.0)

accelerate PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - a2 =0.10.5, =0.2.3, =0.0.3, =0.7.16, =0.0.1, =0.1.0, =4.0.0rc4, =0.3.0, =1.0.3.post1, =0.1.0, =1.0.9, =0.1.0, =0.1.1 - stepgot 0.1.0 and mo...

atomgpt (2024.11.30), autotrain-advanced (>=0.7.119, <=0.8.5) +28 more potentially affected by CVE-2026-69112 via accelerate (0.31.0)

accelerate PYPI version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - atomgpt 2024.11.30 - autotrain-advanced =0.7.119, =0.1.3, =0.1.0, =0.0.4.5, =0.1.0, =0.3.1, =1.0.0, =0.1.0, =0.1.9 - ragcheckerzsv4 0.1.0 -...

aesthetic-predictor-v2-5 (2024.5.28.1), animica (0.1.1) +36 more potentially affected by CVE-2026-69112 via accelerate (0.34.2)

accelerate PYPI version 0.34.2 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - aesthetic-predictor-v2-5 2024.5.28.1 - animica 0.1.1 - ares-ai =0.1.1, =1.1.2b20241107, =1.1.2b20241107, =1.3.0, =0.9.0, =0.1.0, =0.4.0rc2,...

MAL-2026-13712 Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

MAL-2026-13710 Malicious code in neutrl-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a9fd4e018ce439288641c2bb6098fcfab811252142bcff5280e2b842aade9f providers.py in neutrl-core 2.0.2 contains a covert routine named handleanalytics that, when a JSON-RPC response includes cfg == 'collect', scrapes...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-688...

Malicious Package

Overview plp-contract is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bigtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...