Hardcoded credentials

ToUI is a Python package for creating user interfaces websites and desktop apps from HTML. ToUI is using Flask-Caching SimpleCache to store user variables. Websites that use Website.uservars property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1...

CVE-2023-33175 ToUI allows user-specific variables to be shared between users

ToUI is a Python package for creating user interfaces websites and desktop apps from HTML. ToUI is using Flask-Caching SimpleCache to store user variables. Websites that use Website.uservars property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1...

ToUI 安全漏洞

ToUI is a Python package for creating user interfaces websites and desktop applications from HTML. A security vulnerability exists in ToUI versions 2.0.1 through 2.4.0 that stems from the use of the website.uservars attribute...

Malicious code in cxfreezepy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 98b9fe0f574ed33e0a4096ba8774936c73969493c1621244334a739ef4f94f5d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

PyPI Implements Mandatory Two-Factor Authentication for Project Owners

The Python Package Index PyPI announced last week that every account that maintains a project on the official third-party software repository will be required to turn on two-factor authentication 2FA by the end of the year. "Between now and the end of the year, PyPI will begin gating access to...

Malicious code in pyclack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a5bbfd7bb3c6e08fcaab006836d25519f6f790a3e647e64dd210e0b6f464d490 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

Malicious code in oculoushide (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9b7403cc73bb98e45396c93de766686608f4d7f80a03e6e8af73d244de0c7fe1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in this-is-malware (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a09f1ea3e612edb3afa0fb412d98d5c1ce03b4303b89288ce84357b49b25a3ac The OpenSSF Package Analysis project identified 'this-is-malware' @ 0.1.0 pypi as malicious. It is considered malicious because: - The package...

PyPI Repository Under Attack: User Sign-Ups and Package Uploads Temporarily Halted

The maintainers of Python Package Index PyPI, the official third-party software repository for the Python programming language, have temporarily disabled the ability for users to sign up and upload new packages until further notice. "The volume of malicious users and malicious projects being...

Malicious code in opencv-keras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1f3dbc8704eb128ec656854e38ccd3c45d1232978eed378bb7711837dddd09bf The OpenSSF Package Analysis project identified 'opencv-keras' @ 17.10.13 pypi as malicious. It is considered malicious because: - The package...

Malicious code in sqlalchemy-os (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0e9079084215abb63a9468cc5ba89b5275afec40b081f77e9518498eb56a0c30 The OpenSSF Package Analysis project identified 'sqlalchemy-os' @ 14.0.10 pypi as malicious. It is considered malicious because: - The package...

Malicious code in req-flask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a1a249da7f5d65ac080890111e76921348e8eadbfca48a449be1319f9c65982c The OpenSSF Package Analysis project identified 'req-flask' @ 2.9.4 pypi as malicious. It is considered malicious because: - The package...

Malicious code in sqlalchemy-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis be7d898e9281f3e8f393a19f3b1e4eece53fe128076fb65cc38c73116fc8de64 The OpenSSF Package Analysis project identified 'sqlalchemy-requests' @ 7.1.1 pypi as malicious. It is considered malicious because: - The packa...

Malicious code in pygame-install (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93390eea0977ef15ff0c7413e64df5bd99497ea76e9238097ee0b6f4b9862fdd The OpenSSF Package Analysis project identified 'pygame-install' @ 17.14.20 pypi as malicious. It is considered malicious because: - The package...

Malicious code in beautifulsoup-numpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 199bccf9ed40ab3dcd67c494f1b1b52cd3fa78beed3bc25e851cb0f14db9b60b The OpenSSF Package Analysis project identified 'beautifulsoup-numpy' @ 10.13.10 pypi as malicious. It is considered malicious because: - The...

Malicious code in pygame-pytorch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c104a6d866e764da7907147cd7def349f360987498156433ef1e11bf4ac2263c The OpenSSF Package Analysis project identified 'pygame-pytorch' @ 3.4.19 pypi as malicious. It is considered malicious because: - The package...

Malicious code in pandas-numpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ad64cd7fe8db5e273a5e994ca67fcc44546298765caf11ec2edcd0d587481434 The OpenSSF Package Analysis project identified 'pandas-numpy' @ 8.19.3 pypi as malicious. It is considered malicious because: - The package...

Malicious code in crypto-pygame (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 12204aa041b42e90b2749e8026e866fbe3d5ff07e79899073fbc585b9950b727 The OpenSSF Package Analysis project identified 'crypto-pygame' @ 10.14.7 pypi as malicious. It is considered malicious because: - The package...

Malicious code in print-pip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b212a33e119ddadecf30da008a6e74a0b1c954521ae1a596e715f201c0abf281 The OpenSSF Package Analysis project identified 'print-pip' @ 13.9.3 pypi as malicious. It is considered malicious because: - The package...

Malicious code in requests-pandas (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 466aafb46bc841bddc0afbb05274ddf5c303d04e389298842ce36325e6809744 The OpenSSF Package Analysis project identified 'requests-pandas' @ 3.10.17 pypi as malicious. It is considered malicious because: - The package...