6 matches found
PYSEC-2026-590 Malicious code in executor-http (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of executor-http were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials a...
bioimageio-engine (>=0.1.0, <=0.1.3), executor-http (>=0.1.0, <=0.1.2) +7 more potentially affected by unknown CVE via executor-engine (0.3.3)
executor-engine PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on executor-engine and may be impacted: - bioimageio-engine =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.5.0, =0.5.4 Source cves: unknown CVE Source advisory:...
mrbios (0.1.0) potentially affected by unknown CVE via executor-http (0.1.2)
executor-http PYPI version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on executor-http and may be impacted: - mrbios 0.1.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-EXECUTORHTTP-17220138...
Malicious code in executor-http (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde4da7201fbc0dd3ae09240232f5767c2893e33977d6c8ee9071d15e79f0363 The package ships executorhttp-setup.pth, which Python auto-loads at interpreter start for any environment where the package is installed. The.pth fi...