CVE-2025-32800 Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary malicious code to the package, and then exploit...

Malicious code in eslint-config-airbnb-compat (npm)

The npm package eslint-config-airbnb-compat is a malicious package impersonating the legitimate Airbnb ESLint configuration. It implements a multi-stage remote code execution attack: 1. The package uses a seemingly benign postinstall script that sets up an environment variable pointing to a...

Unsafe Dependency Resolution

Overview python-json-logger is a JSON Log Formatter for the Python Logging Package Affected versions of this package are vulnerable to Unsafe Dependency Resolution through the deletion of a critical dependency which could be maliciously claimed by a third party. An attacker can execute arbitrary...

Malicious code in compute-st-speed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 35e058e2655bdae9fb5cef9e594f9f1dcc59206620e758c625c9cdee1e0634a8 Infostealer with multiple possibilities, but not auto-activating on installation. There are already multiple attempts to publish it, with different...

MAL-2025-191705 Malicious code in computestpspeedcompcomp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 559d64721f5c40906b8c1ba33cf19ffb4a4ae4de9837c442be7c54a0ba1b3b6d Infostealer with multiple possibilities, but not auto-activating on installation. There are already multiple attempts to publish it, with different...

Malicious code in dependency00011124931 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8fa6dafeedc48e6511a70676806da412d047f7f235f471a29c98afb9931cbbf2 Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

Malicious code in bananaholder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75eb68c36b36e5abf8c54609a124590a23d388ef04d2825da3bd83f8e90c7f46 A dependency is declared as installable from a webhook service, demonstrating a possibility to inject malicious dependency. --- Category: PROBABLYPENTEST -...

The vulnerability of the Python programming language-based keep package allows a hacker to execute arbitrary code.

The vulnerability of the Python programming language-based keep package is related to the presence of the malicious dependency “request” without s. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the api-res-py package in the Python programming language allows a perpetrator to execute arbitrary code.

The vulnerability of the api-res-py package for the Python programming language is related to the presence of the malicious dependency “request” without s. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Python programming language package “pyanxdns” allows a perpetrator to execute arbitrary code.

The vulnerability of the Python programming language package “pyanxdns” is related to the presence of the malicious dependency “request” without “s”. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2022-3393 · Pypi · Request +1

Name of the Vulnerable Software and Affected Versions: keep versions prior to 1.2 Description: The issue is related to a code-execution backdoor inserted by a third party in the keep package for Python. This backdoor is associated with a malicious dependency named request. Exploitation of this...