10749 matches found
khoj-assistant (>=1.21.0, <=1.21.1) potentially affected by CVE-2025-69207 via khoj (1.42.10)
khoj PYPI version 1.42.10 is affected by a known vulnerability. The following packages have a transitive dependency on khoj and may be impacted: - khoj-assistant =1.21.0, =1.21.1 Source cves: CVE-2025-69207 Source advisory: SNYK:PYTHON-KHOJ-15182646...
Malicious code in credit-decision-metrics (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4a0320017dad96c95d4741c311ead566b7d6bea0c7ffdceea82b435ce74a40de Obfuscated code is used to hide exfiltration of basic data hostname, etc.. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but...
MAL-2026-641 Malicious code in connections-api-requests (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5d9023bd1b2434b0519e9f26fe6d776297700ef0d80c05ba50ead13c6e3d61bb Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
Malicious code in hangimani (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4eb1b67eac28a42f372ecaaca274a28d15972e3cc8e063492f977364538e6c41 During importing the module, package downloads a second-stage code from GitHub, which then runs an infostealer. After that, the downloaded code is removed ---...
flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-71011 via oneflow (0.9.0)
oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-71011 Source advisory: SNYK:PYTHON-ONEFLOW-15162560...
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
A PyPI user account compromised by an attacker and was able toupload a malicious version 1.1.5.post1 of the dydx-v4-client package.This version contains a highly obfuscated multi-stage loaderthat ultimately executes malicious code on the host system.While the final payload is not visible because ...
flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-71003 via oneflow (0.9.0)
oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-71003 Source advisory: SNYK:PYTHON-ONEFLOW-15162568...
Malicious code in morty-package (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d87e4d2c5f3096d67a98e166e70ed6d4288c7d7554852e8d14bb60213f9a574b Package presents an extremely deep obfuscation of a code that is imported during installation. The exact behavior is unknown, but it includes loading encrypted...
flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-71002 via oneflow (0.9.0)
oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-71002 Source advisory: SNYK:PYTHON-ONEFLOW-15162572...
flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-71000 via oneflow (0.9.0)
oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-71000 Source advisory: SNYK:PYTHON-ONEFLOW-15162574...
Malicious code in pypi-package-explore (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 54257ec88b5f7a5bd69177f84a4c396ab208e727ba1c7b079056f1fab2705c37 Package presents an extremely deep obfuscation of a code that is imported during installation. The exact behavior is unknown, but it includes loading encrypted...
pamai (>=1.0.0, <=1.0.5) potentially affected by CVE-2025-33234 via runx (0.0.11)
runx PYPI version 0.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on runx and may be impacted: - pamai =1.0.0, =1.0.5 Source cves: CVE-2025-33234 Source advisory: SNYK:PYTHON-RUNX-15146881...
Malicious code in system-integration-toxi (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 096a1a342309a85666ad92b45da1da18ca808e16c93819a3122b2c6bbc2a15d6 During importing the module, code downloads and executes a remote script. During the analysis of this package, the code was a placeholder, but the package is...
dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +31 more potentially affected by CVE-2026-0768 via lfx (>=0.1.13, <=1.13.0.dev5)
lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1rc0, =0.1.5 and more Source cves: CVE-2026-0768 Source advisory: SNYK:PYTHON-LFX-15091578...
dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +31 more potentially affected by CVE-2026-0771 via lfx (>=0.1.13, <=1.13.0.dev5)
lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1rc0, =0.1.5 and more Source cves: CVE-2026-0771 Source advisory: SNYK:PYTHON-LFX-15091580...
jf-langflow (>=1.10.0, <=1.10.0.post7), langflow (>=1.8.0rc0, <=1.8.0rc2) +1 more potentially affected by CVE-2026-0772 via langflow-base (>=0.7.2, <=0.11.6)
langflow-base PYPI version =0.7.2, =1.10.0, =1.8.0rc0, =1.8.0rc2 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-0772 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15091577...
dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +31 more potentially affected by CVE-2026-0769 via lfx (>=0.1.13, <=1.13.0.dev5)
lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1rc0, =0.1.5 and more Source cves: CVE-2026-0769 Source advisory: SNYK:PYTHON-LFX-15091581...
MAL-2026-469 Malicious code in cflashfiles (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d8c5174968b7dedf000076201fe6446018aa61048b6a77fc8bc42e16bb796fd9 Malicious clone of legitimate fsspec package. The code was modified to exfiltrate specific files on import. --- Category: MALICIOUS - The campaign has clearly...
