Malicious code in reqcrypt-dev (PyPI)

Source: kam193 8e66755912c02a4de1ed6f86b092e2a0dcdadbcaef931cbd07c6d2306619f3e4 The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, a...

BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

MAL-2026-14274 Malicious code in reqcrypt-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...

Malicious code in reqcrypt-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...

Malicious code in deepface-weight (PyPI)

Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for approximately 10 minutes and POSTs the file to a hardcoded...

Malicious code in deepface-weights (PyPI)

Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working directory. When found, it POSTs the session file together...

PT-2026-79929

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked extensions...

PT-2026-80643

JupyterLab's PyPI extension manager enforces blocked extensions uris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

MAL-2026-14158 Malicious code in deepface-weight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...

Malicious code in deepface-weight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...

Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

MAL-2026-14132 Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

Malicious code in infogram-bot (PyPI)

Source: kam193 454fa32963f58275e35167d59dd581240725e099682e76e44b6fca7b22332cb0 The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. --- Category: MALICIOUS - The campaign has...

Malicious code in httpz-requests (PyPI)

Source: kam193 38eff923106836997e28de6d7173a1553da126be230b341fe64f0c4c215769a2 The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. This package automatically ensures persistenc...

devpi-web (2.6.0) potentially affected by CVE-2026-54723 via devpi-server (2.6.1)

devpi-server PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on devpi-server and may be impacted: - devpi-web 2.6.0 Source cves: CVE-2026-54723 Source advisory: OSV:GHSA-M5PQ-69XG-VCQ3...

monailabel (0.4.1), monailabel-weekly (0.4.0.dev2228) +2 more potentially affected by CVE-2026-100845 via monai (0.9.0)

monai PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - monailabel 0.4.1 - monailabel-weekly 0.4.0.dev2228 - neurips-cellseg-gc =0.0.1, =0.1.5, =0.1.10 Source cves: CVE-2026-100845 Source advisory:...

magms (>=1.1.0, <=2.0.2) potentially affected by CVE-2026-100845 via monai (0.9.1)

monai PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - magms =1.1.0, =2.0.2 Source cves: CVE-2026-100845 Source advisory: OSV:GHSA-WG9G-W2J2-8PGR...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by unknown CVE via monai (>=1.0.0, <=1.5.2)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MONAI-18960423...