MAL-2025-4206 Malicious code in ark-vmp-reverse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 28ac22df743a6a65eed4d1d25f66c0f3eb42c5235dc749a84162883d313bd415 During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

MAL-2025-4207 Malicious code in byted-torch-monitor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8c2b83888c7fcb79b930eaecb1a538d27a131ab415c0b756f84c7071d5a0935b During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

MAL-2025-3482 Malicious code in web3rpcs (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3481 Malicious code in web3rpc (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3480 Malicious code in web3connectpy (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3472 Malicious code in sxz (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3470 Malicious code in sincpro-logger (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3456 Malicious code in pyapimove (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3445 Malicious code in evm-validator (PyPI)

--- -= Per source details. Do not edit below this line.=-...

GCP Cloud Composer Bug Let Attackers Elevate Access via Malicious PyPI Packages

Cybersecurity researchers have detailed a now-patched vulnerability in Google Cloud Platform GCP that could have enabled an attacker to elevate their privileges in the Cloud Composer workflow orchestration service that's based on Apache Airflow. "This vulnerability lets attackers with edit...

MAL-2025-4203 Malicious code in aioasyncsqlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9dabf7e852a633394c9df21ee491c5a3582e2c172c624fd2b48cc127dbdc410a Clone of aiosqlite with hidden exfiltration of selected data during "executeall" query see L59-97 --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-4204 Malicious code in aiolitesql (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1ef59c4a17296925677ec69703d25a3bd0541eb1c20eba25b0bc6918e908ddcf Clone of aiosqlite with hidden exfiltration of selected data during "executeall" query see L59-97 --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-4238 Malicious code in reqinstall (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fabb4dfb4f519f848a714f96e09e2b5fbb289ffdd8cd86fc13c8fbf49b539962 Campaign is split into multiple packages that altogether exfiltrates data from desktop Telegram application. 1. "pyapiepo" is a cover package that provides som...

adorable-cli (>=0.1.10, <=0.2.9), agent-memory-labs (>=0.1.0, <=0.1.14) +163 more potentially affected by CVE-2025-28197 via crawl4ai (>=0.3.731, <=0.9.3)

crawl4ai PYPI version =0.3.731, =0.1.10, =0.1.0, =0.2.1, =0.1.6, =0.1.0, =0.6.0, =0.1.0, =0.1.2, =0.1.0, =0.1.10, =0.10.0, =0.12.0, =0.5.3, =0.5.4 and more Source cves: CVE-2025-28197 Source advisory: SNYK:PYTHON-CRAWL4AI-10116190...

autoxx (>=0.0.11, <=0.0.13), vuln-demo-math-ops (1.0.0) potentially affected by CVE-2025-31491 via agpt (0.2.2)

agpt PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on agpt and may be impacted: - autoxx =0.0.11, =0.0.13 - vuln-demo-math-ops 1.0.0 Source cves: CVE-2025-31491 Source advisory: SNYK:PYTHON-AGPT-9802316...

autoxx (>=0.0.11, <=0.0.13), vuln-demo-math-ops (1.0.0) potentially affected by CVE-2025-31490 via agpt (0.2.2)

agpt PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on agpt and may be impacted: - autoxx =0.0.11, =0.0.13 - vuln-demo-math-ops 1.0.0 Source cves: CVE-2025-31490 Source advisory: SNYK:PYTHON-AGPT-9802320...

soprano-tts (0.0.2) potentially affected by CVE-2025-3163 via lmdeploy (0.17.0)

lmdeploy PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on lmdeploy and may be impacted: - soprano-tts 0.0.2 Source cves: CVE-2025-3163 Source advisory: SNYK:PYTHON-LMDEPLOY-10343889...

soprano-tts (0.0.2) potentially affected by CVE-2025-3162 via lmdeploy (0.17.0)

lmdeploy PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on lmdeploy and may be impacted: - soprano-tts 0.0.2 Source cves: CVE-2025-3162 Source advisory: SNYK:PYTHON-LMDEPLOY-9723887...

21cmpsdenoiser (>=1.0.0, <=1.0.2), 2404-segmentation-pipeline (>=0.1.0, <=1.0.0) +28224 more potentially affected by CVE-2025-3136 via torch (>=1.0.0, <=2.14.0)

torch PYPI version =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =2.13.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.16 and more Source cves: CVE-2025-3136 Source advisory: SNYK:PYTHON-TORCH-10337825...

21cmpsdenoiser (>=1.0.0, <=1.0.2), 2404-segmentation-pipeline (>=0.1.0, <=1.0.0) +28224 more potentially affected by CVE-2025-3121 via torch (>=1.0.0, <=2.14.0)

torch PYPI version =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =2.13.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.16 and more Source cves: CVE-2025-3121 Source advisory: SNYK:PYTHON-TORCH-10337834...