fabric

|version| |python| |license| |ci| |coverage| .. |version| image:: https://img.shields.io/pypi/v/fabric :target: https://pypi.org/project/fabric/ :alt: PyPI - Package Version .. |python| image:: https://img.shields.io/pypi/pyversions/fabric :target: https://pypi.org/project/fabric/ :alt: PyPI -...

Malicious code in numprint (PyPI)

Source: kam193 ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243 During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in numprint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint hardcoded C2, credential...

MAL-2026-18343 Malicious code in numprint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint hardcoded C2, credential...

Malicious code in qowa (PyPI)

Source: kam193 67fe6a2b86c60720a8e3cc1002c183bd751ec1896d3be13a44b5ce7d1623afbd The package provides a C2 server and agent with pre-filed credentials, disguised as a generic utility. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-qowa...

MAL-2026-18218 Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5 src/qowa/init.py contains calls to socket.gethostname at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints...

Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5 src/qowa/init.py contains calls to socket.gethostname at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints...

PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

TeamUpdraft has disclosed unauthorized access to itsteamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer...

PT-2026-116245

Уязвимость функции check remote commands платформы для мониторинга безопасности и обнаружения угроз Wazuh связана с недостатками механизма обработки регистрозависимых данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с правами root...

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2...

Malicious code in beautifytext (PyPI)

Source: kam193 cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b During import, the package silently spans a separate process that waits for and executes remote commands. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

MAL-2026-17417 Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

CVE-2026-88285 GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands...

Malicious code in telegram-helper (PyPI)

Source: kam193 7db7944f424aaa877ab4c7d4555c4358900d45011b05a886837a14efea2a72a9 The package hides code that starts a Telegram bot to exfiltrate sensitive session files and cookies --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in boto4 (PyPI)

Source: kam193 b928f1f0d3af6242391cc626a8601d24f60c70d862bfebe6cfe0777c13a8c0b2 During installation, package executes an embedded executable. The executable is capable of executing remote commands, establishing persistence, cryptomining, exfiltrating basic data, further network scanning and...

Malicious code in plp-contract (PyPI)

Source: kam193 78e1b9f0edcbb33baf6d6ee4137978c45f940943f58a3648970b48eb5fef209d This package intentionally depends on a malicious package. This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other credentials. The malicious code is hidden in a dependency package...

MAL-2026-13686 Malicious code in chaintest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...

MAL-2026-13685 Malicious code in pytablute (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89c8605077eecd12f249b3698da0cc2b60f54ecca01041a16221882d1ee6a4b1 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

MAL-2026-13605 Malicious code in yakuza0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9952a92dd18e2353ebb4f2d8064884e7be770d23770096af6dbe1844d8b5fd6 The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjbill.ren, from cli/index.js...