Malicious code in fetchapi-syncdata-pypi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0dcf5bd5c71d077b3763c74d57d68d5517a2b5c5229fdd5bd6f7369cb2a0f49 The package contains code to download and start a malicious executable. It's masqueraded using name similar to Windows services. In analyzed versions, the code...

MAL-2026-3133 Malicious code in fetchapi-syncdata-pypi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0dcf5bd5c71d077b3763c74d57d68d5517a2b5c5229fdd5bd6f7369cb2a0f49 The package contains code to download and start a malicious executable. It's masqueraded using name similar to Windows services. In analyzed versions, the code...

MAL-2026-3105 Malicious code in mypypipkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a94a9bbd6a292f754fedd6ae737eaf5259925cf382a610c9d63e9d210a3f3677 When running as a module, the package starts a VSCode tunnel and exfiltrates the connection link to the hardcoded target. This lets the attacker connect the...

MAL-2026-3091 Malicious code in bytedfaas (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec7e2decd402442fba2d4ebd7637b596a33ef132120ffe4f3a8b5d2d6ce8475e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-3084 Malicious code in byteclaw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3fe21c4a32b814a0b46b75a26033bae1f40e1caa237e394842aff14639b7aaec Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in test-pkg-jie (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bc409f90d96c576263a60bd95ab30260b973097425292cdd53999e49cb3c4011 During installation, the package attempts to create a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

adclaw (>=1.0.0, <=1.0.33), agentbase-memory-agentscope (0.1.0) +47 more potentially affected by CVE-2026-6606 via agentscope (>=0.1.0, <=2.0.9)

agentscope PYPI version =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.2.0, =0.1.5, =2.1.0, =1.0.0.post2, =0.1.0b1, =0.1.0, =1.0.4 and more Source cves: CVE-2026-6606 Source advisory: SNYK:PYTHON-AGENTSCOPE-16318346...

adclaw (>=1.0.0, <=1.0.33), agentbase-memory-agentscope (0.1.0) +47 more potentially affected by CVE-2026-6605 via agentscope (>=0.1.0, <=2.0.9)

agentscope PYPI version =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.2.0, =0.1.5, =2.1.0, =1.0.0.post2, =0.1.0b1, =0.1.0, =1.0.4 and more Source cves: CVE-2026-6605 Source advisory: SNYK:PYTHON-AGENTSCOPE-16318345...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +1 more potentially affected by CVE-2026-6599 via langflow-base (>=0.7.2, <=0.11.6)

langflow-base PYPI version =0.7.2, =1.10.0, =1.8.0rc0, =1.8.0rc2 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-6599 Source advisory: SNYK:PYTHON-LANGFLOWBASE-16110821...

MAL-2026-2843 Malicious code in shan-lib-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f6c2f4a0560b1811eba11c9fd304f7441ab7e04f4e569e01bdfe06aba6722edb Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2840 Malicious code in sher-server-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e83ee8187475c07ed6ea406a698e3f9d3c55efec8e689ba0c110a6ee2ce1012b Starting the module activates a hardcoded telegram bot allowing remote code execution, data exfiltration, collecting webcam photos, clipboard data, etc. ---...

Malicious code in restasv3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8b1f1a7427290168b0acaa2bd682cb33a9d3384eb9f0ea95d2bbd295152bfff7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in robase-quick-install (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f69377c01d5c0980cb9bf905be35133e5cd077e7c64c577460dc06e3871c2d9e During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1820 more potentially affected by CVE-2026-41312 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41312 Source advisory: SNYK:PYTHON-PYPDF2-16097902...

MAL-2026-2811 Malicious code in requests-test-test3 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-6118 via astrbot (>=4.27.2, <=4.28.2)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-6118 Source advisory: SNYK:PYTHON-ASTRBOT-16427898...

MAL-2026-2561 Malicious code in robase-help (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b83143e22b0a815d6a2702f547ae9f4620ee086c8b9360a0d60ff2ed2186d56b During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in ks-hex2pcap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 90b58f7aa303c563186a1d1c2a89d13caec4e0c04a48f6838fcba294b7846e96 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2540 Malicious code in gd-auth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 baa9851d66a8d40c23baf029f186e4f8f5366381dadb2d3ecc8cb9420e5e3997 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in ttam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2925c78ff71ef8aee744b1b6b4fa9b5cef3b6ae018447d29ba5e63fe43ad01c1 Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...