Malicious Package

Overview joule-sbx-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13756 Malicious code in joule-sbx-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c460336aaf7e02cc7b37e4a0e58df5e22431f9de9ea852af21bb1aa2f333039c During installation, the code exfiltrates basic information and exfiltrates more information to a localhost service as well as starts a reverse shell there. It...

Malicious code in joule-sbx-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c460336aaf7e02cc7b37e4a0e58df5e22431f9de9ea852af21bb1aa2f333039c During installation, the code exfiltrates basic information and exfiltrates more information to a localhost service as well as starts a reverse shell there. It...

MAL-2026-13757 Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

agent-toolkit (0.1.9), ailite (>=6.0.2, <=6.1.10) +51 more potentially affected by CVE-2026-72742 via dspy (>=0.1.5, <=3.3.0b1)

dspy PYPI version =0.1.5, =6.0.2, =0.1.0, =0.7.7, =0.3.5, =0.1.9, =0.1.0, =2.5.5, =0.1.0.dev0, =0.3.5, =0.6.9 and more Source cves: CVE-2026-72742 Source advisory: MEND:CVE-2026-72742...

aibro (>=0.5.5, <=1.1.5), aioambient (>=0.1.1, <=1.2.2) +231 more potentially affected by CVE-2026-48802 via python-engineio (>=3.2.2, <=4.13.1)

python-engineio PYPI version =3.2.2, =0.5.5, =0.1.1, =0.1.1, =4.0.6, =0.16.0, =2.3.0, =1.0.5, =0.9.0, =0.0.3, =4.0.2, =4.0.0.8, =0.1.0, =0.1.5 - baseweb 0.0.5 and more Source cves: CVE-2026-48802 Source advisory: MEND:CVE-2026-48802...

Malicious code in euler-sdk (PyPI)

Source: kam193 e53c3aac169dec167a2e67afdfaff8f16408781a31dc6516afe115df3ffcc425 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in morpho-sdk (PyPI)

Source: kam193 cb58dff63faa08e128ddd0d8d38b82c0711bb60d09d19755a8e8f398fa7d511d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

MAL-2026-13732 Malicious code in joule-btp-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91439e7a69d936aa8a65b16561f48e9d9abab26fc8e3af4087da8d367cfd2210 On pip install, setup.py runs a collectandexfiltrate routine that reads /private/etc/passwd, /private/etc/hosts, and /private/etc/sudoers; captures...

Malicious code in joule-btp-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91439e7a69d936aa8a65b16561f48e9d9abab26fc8e3af4087da8d367cfd2210 On pip install, setup.py runs a collectandexfiltrate routine that reads /private/etc/passwd, /private/etc/hosts, and /private/etc/sudoers; captures...

MAL-2026-13730 Malicious code in euler-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e53c3aac169dec167a2e67afdfaff8f16408781a31dc6516afe115df3ffcc425 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in euler-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e53c3aac169dec167a2e67afdfaff8f16408781a31dc6516afe115df3ffcc425 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in morpho-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cb58dff63faa08e128ddd0d8d38b82c0711bb60d09d19755a8e8f398fa7d511d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-13731 Malicious code in morpho-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cb58dff63faa08e128ddd0d8d38b82c0711bb60d09d19755a8e8f398fa7d511d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious Package

Overview euler-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in dlmm-sdk (PyPI)

Source: kam193 007be0fc2d53a2c72f277ddb12c24bb04ae1e17d2bf03f83b70367c3bf1b9122 During import the package exfiltrates sensitive env variables and credential files. In addition, listings of cryptocurrency wallet directories are collected. --- Category: MALICIOUS - The campaign has clearly maliciou...

Malicious Package

Overview dlmm-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview joule-btp-extension is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in dlmm (PyPI)

Source: kam193 044faa804b628c1751f6fa5f66a5f8835ecda1f4d2837ae70411d4630a0607ad Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in dlmm-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ddf2d03d839f7eff709e78da1d6a85226cdd3b9171dbcb59a4a95c741e0773e The package's top-level module runs a report routine on import, and setup.py invokes the same import at install time. The routine collects environmen...