MSC-2026-12689

The PyPI package lore-cs version 1.0.0 source distribution is a dependency-confusion package with a malicious install hook. setup.py calls a beacon function at module level, so any pip install from source silently POSTs the hostname, install path and current working directory to an...

MAL-2026-14069 Malicious code in kb-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d69143a6cdc0a652f91210034751420f7ada3db2a13d81d9e635e3a63333dc5 On import kbai, the package's init.py triggers kbai.utils.callback, which starts a background thread that collects installer host identifiers hostnam...