MAL-2026-14588 Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

ROOT-APP-PYPI-CVE-2026-54284 CVE-2026-54284 in sqlparse - Patched by Root

Root has patched CVE-2026-54284 in the sqlparse package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-27JP-WM6Q-GP25 GHSA-27jp-wm6q-gp25 in sqlparse - Patched by Root

Root has patched GHSA-27jp-wm6q-gp25 in the sqlparse package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-4340 CVE-2024-4340 in sqlparse - Patched by Root

Root has patched CVE-2024-4340 in the sqlparse package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-62QF-JCQ8-8GXW GHSA-62qf-jcq8-8gxw in sqlparse - Patched by Root

Root has patched GHSA-62qf-jcq8-8gxw in the sqlparse package for Root:PyPI. Multiple fixed versions available...

MAL-2026-14555 Malicious code in ekx-report-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78 On import, the package runs a setup routine that reads a session credential from /tmp/.sandboxtoken and issues an authenticated GET to...

Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...

MAL-2026-14545 Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

Malicious code in minecraft-ytreceiver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...

MAL-2026-14516 Malicious code in minecraft-ytreceiver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...

abraham3k (>=1.3.8, <=1.5.3), accutuning-helpers (>=1.0.32, <=1.0.33) +75 more potentially affected by CVE-2026-76843 via flair (>=0.4.5, <=0.15.1)

flair PYPI version =0.4.5, =1.3.8, =1.0.32, =0.0.1, =0.1.0, =0.0.6, =0.1.20, =0.1.0, =0.1.0, =0.0.1.1, =0.2.4, =0.1.1, =0.0.1rc2, =0.0.1rc3488056308109 and more Source cves: CVE-2026-76843 Source advisory: SNYK:PYTHON-FLAIR-19256938...

MAL-2026-15693 Malicious code in py-devoli-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a1bb1bf9c4c225131c5ad323e7b0c1a9f29f34aea30a496ac77661ea05605d The package was found to contain malicious code or consuming dependency that contains malicious code...

Malicious code in py-devoli-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a1bb1bf9c4c225131c5ad323e7b0c1a9f29f34aea30a496ac77661ea05605d The package was found to contain malicious code or consuming dependency that contains malicious code...

ROOT-APP-PYPI-CVE-2026-54911 CVE-2026-54911 in ujson - Patched by Root

Root has patched CVE-2026-54911 in the ujson package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-32875 CVE-2026-32875 in ujson - Patched by Root

Root has patched CVE-2026-32875 in the ujson package for Root:PyPI. Multiple fixed versions available...

Malicious code in envprovision (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a414ad5404fdeeb23c37f1580aeee8175765ba8613e8fadd1a0254bf0e25d2f6 envprovision 1.4.0 presents itself as an environment-diagnostics helper but its public check/sync API, on Windows, fetches a JSON manifest from a...

Malicious code in cryptgraphy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7f362d84083dd8b3398e66da8abc40aecb79fd1d7b1b42d32938f9089bd3d2 The package impersonates the cryptography/boto3 ecosystem via a typosquatted name and falsified metadata author 'AWS Support Team' , url...

Malicious code in scrambleeeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer opens a TCP socket to bax.h4x.tv:6363, duplicates...

MAL-2026-14358 Malicious code in scrambleeeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer opens a TCP socket to bax.h4x.tv:6363, duplicates...