MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0f81b904b849df393cbe5c34f952af65d8b28e0797e33d62cf964df77d4929c7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11426 Malicious code in trtllm-subdir-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e8cdbb30c1c2ddf88a76d18b935d4accf68155f936b5df59a8864fafd7f4e06f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11424 Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-11423 Malicious code in asdk-plugin-legacy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 65dd9dd087b805a16fb5d68c92cf2be0ec28fec162d75bb0eb81bb8d9bcfb61a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11416 Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a11e86f01cbd23fcc0453904b7991ddaaf87582fde3bcc3b48686a28213c46d9 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11420 Malicious code in walmart-genai-trace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e84b4bbb5660ea5c7f803c4e5d0b12dfe41c9bb147fd2228c72bdda2224291a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11199 Malicious code in ml-data-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff7fbcc539a2758c962aa64220b3ec62668dbd4a248fb8910956eb64ab7bd3ba During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11201 Malicious code in ml-nps-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fed6e01148ede73fae9d01667807eb310434a9c801b9eb60f08141e34921fc85 During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11200 Malicious code in ml-fdbk-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11202 Malicious code in ml-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4f4ae8fee891c54953efa7c796a605e700fc827131feff0243f0b3bc8bd6a260 During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75c59285ee1a5a83447815e7402410ccfca6a287e0c36d61bcfda3d55396f608 Versions published in 2026-07 after the package was removed by the original author and the name was re-registered by another contain a stub 'share compute swar...

pip: pip: Arbitrary file installation via malicious package indexes

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

CVE-2026-13346

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

MAL-2026-11195 Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1e92e5b2c5182be4ddf6a9acced6db4e6bb3c7413970c931b4abd47910b1bb26 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-59948

A flaw was found in Composer, a dependency manager for the PHP language. A remote attacker could exploit this vulnerability by providing a maliciously crafted package from an untrusted source. During installation or update, Composer's improper validation of package names allows it to write...

MAL-2026-11170 Malicious code in @finxsecdemo/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f6ca8fa85d211056af32639b18f95f13c362b2764d85c812e6741d6747abf94d The OpenSSF Package Analysis project identified '@finxsecdemo/utils' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2026-11192 Malicious code in test2221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 178c9841a69c4a2de3ad248f8d4dbba8f004c8e8947a34f9e6ae12404183e6e2 The OpenSSF Package Analysis project identified 'test2221' @ 2.2.4 npm as malicious. It is considered malicious because: - The package executes...

MAL-2026-11157 Malicious code in @mypwn/hawkeye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc7070d4697e41f7bd953772681425e677c8ca9539144154b7abde925adef545 The OpenSSF Package Analysis project identified '@mypwn/hawkeye' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2026-11139 Malicious code in kordyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52bb92157f869a5e1da58a19c88743989d44703201f8d1df250c2543b70b6be3 The package's main entry index.mjs contains a chunked base64 blob whose decoded bytes are a Windows PE64 executable MZ/PE header confirmed, including...

MAL-2026-11145 Malicious code in rollup-runtime-core-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199 The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node repository field points to...