Malicious code in test-01-rafamarrara-learning-dc (PyPI)

Source: kam193 c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816 Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands. --- Category:...

Malicious code in twitter-request-diagnostics (PyPI)

Source: kam193 d437e09d0338d5b7640d3132c723bc4c77d95a052b35f7a32335a1d832c799c1 Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands. --- Category:...

Malicious code in twitter-request-diagnostics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca5b20afc78999f71a79a794a2369cfd98a2c54e4782800d52b18319d8ecb32 The package's init entrypoint starts an HTTPServer bound to 0.0.0.0:7331 that implements two unauthenticated remote-access primitives against the...

Malicious code in test-01-rafamarrara-learning-dc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612 Package appears to be a learning/test artifact with no observable malicious behavior. No install-time or import-time network I/O, no credential or...

MAL-2026-18402 Malicious code in test-01-rafamarrara-learning-dc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612 Package appears to be a learning/test artifact with no observable malicious behavior. No install-time or import-time network I/O, no credential or...

CVE-2026-109237 Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with apitoken set to an env reference via /config/dump to read SECRETK...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

Source: kam193 f9a677a1b1a8762a3f01e91a8da196298bf146b255dc7f9d834842916882372b During installation, package exfiltrates environment variables, tokens from cloud environments and fingerprints the environment. It identifies itself as a security testing engagement. --- Category: MALICIOUS - The...

Malicious code in env-variables-extension (npm)

The package env-variables-extension was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in py-1requests (PyPI)

Source: kam193 877b4b612041848c46e9fb32160b85b74e7c3e983a38313017bc8c034e5f93da During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test. --- Category: PROBABLYPENTEST - Packages lookin...

Malicious code in py-2equests (PyPI)

Source: kam193 e77ec1203f9d490621144227c797d33bf3271c674bcc248fbaf16aaeca9bd106 During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test. --- Category: PROBABLYPENTEST - Packages lookin...

Malicious code in 0requests (PyPI)

Source: kam193 b42d4eed37375dfa065db35c2e08365b9557b442c935e645b3e82564c4c32d7c During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test. --- Category: PROBABLYPENTEST - Packages lookin...

Malicious code in py-0requests (PyPI)

Source: kam193 0d447dd088f92d3af66ecad461725f2df268f5f073e22a7293b3f946451933fb During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test. --- Category: PROBABLYPENTEST - Packages lookin...

Malicious code in company-sdk (PyPI)

Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud credentials /.aws, /.azure, /.config/gcloud, package manager...

Malicious code in telemetry-helper (PyPI)

Source: amazon-inspector 26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000 On import telemetryhelper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname, username, current working directory, and the entire process...

Malicious code in telemetry-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000 On import telemetryhelper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname,...

Malicious code in dlmm-sdk (PyPI)

Source: kam193 007be0fc2d53a2c72f277ddb12c24bb04ae1e17d2bf03f83b70367c3bf1b9122 During import the package exfiltrates sensitive env variables and credential files. In addition, listings of cryptocurrency wallet directories are collected. --- Category: MALICIOUS - The campaign has clearly maliciou...

Malicious code in neutrl-core (PyPI)

Source: kam193 f31badf901e75b93290ed22337225d71d1d3e97f2fb7aebd4fcffb4a1ad2bf0f This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other credentials. The malicious code is hidden in a dependency package e.g. neutrl-core in a function disguised as telemetry, and...

Malicious code in neutrl-contracts (PyPI)

Source: kam193 f0a6030f2cc65968de85749a2fafe2380bbb44fdc7db473763c5a82af5d79bc4 This package intentionally depends on a malicious package. This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other credentials. The malicious code is hidden in a dependency package...

Malicious code in mnemonic-py (PyPI)

Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in defi-sdk-py (PyPI)

Source: kam193 b292686db581afeaaa7d53e2281a90d7d470fc71ab9e7d6156c49e2e99a44a30 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...