72493 matches found
agilerl (>=2.4.2.dev0, <=2.7.0), ai2-catwalk (0.2.2) +213 more potentially affected by CVE-2026-69112 via accelerate (>=1.0.1, <=1.14.0)
accelerate PYPI version =1.0.1, =2.4.2.dev0, =0.1.8, =3.1.8, =0.0.0, =0.1.0rc3, =1.0.0, =3.1.0, =3.9.11, =0.6.0, =0.1.0, =0.3.0, =0.8.26, =0.5.0, =0.19.0 and more Source cves: CVE-2026-69112 Source advisory: GHSA-4J2P-28Q2-5M79...
Malicious code in neutrl-core (PyPI)
Source: kam193 f31badf901e75b93290ed22337225d71d1d3e97f2fb7aebd4fcffb4a1ad2bf0f This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other credentials. The malicious code is hidden in a dependency package e.g. neutrl-core in a function disguised as telemetry, and...
Malicious code in plp-contract (PyPI)
Source: kam193 78e1b9f0edcbb33baf6d6ee4137978c45f940943f58a3648970b48eb5fef209d This package intentionally depends on a malicious package. This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other credentials. The malicious code is hidden in a dependency package...
Malicious code in neutrl-contracts (PyPI)
Source: kam193 f0a6030f2cc65968de85749a2fafe2380bbb44fdc7db473763c5a82af5d79bc4 This package intentionally depends on a malicious package. This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other credentials. The malicious code is hidden in a dependency package...
MAL-2026-13712 Malicious code in bigtime (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...
Malicious code in bigtime (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...
MAL-2026-13710 Malicious code in neutrl-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a9fd4e018ce439288641c2bb6098fcfab811252142bcff5280e2b842aade9f providers.py in neutrl-core 2.0.2 contains a covert routine named handleanalytics that, when a JSON-RPC response includes cfg == 'collect', scrapes...
apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (1.4.0)
apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-688...
Malicious Package
Overview bigtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious Package
Overview dlmm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious Package
Overview neutrl-contracts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview plp-contract is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in chaintest (PyPI)
Source: kam193 4923d010301ea929207d0a1c87e876ca24203fdff90bad313efc3df58879555a The package contains a cryptocurrency infostealer that exfiltrates information from browsers including cryptowallet extensions, synced extensions, local storage and standalone applications password managers,...
Malicious code in pytablute (PyPI)
Source: kam193 89c8605077eecd12f249b3698da0cc2b60f54ecca01041a16221882d1ee6a4b1 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for...
Malicious Package
Overview pytablute is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious Package
Overview chaintest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
ROOT-APP-PYPI-CVE-2026-52726 CVE-2026-52726 in dulwich - Patched by Root
Root has patched CVE-2026-52726 in the dulwich package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-42563 CVE-2026-42563 in dulwich - Patched by Root
Root has patched CVE-2026-42563 in the dulwich package for Root:PyPI. Multiple fixed versions available...