Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

MAL-2026-17240 Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

CVE-2018-6574

CVE-2018-6574 Ejecución remota de comandos en el comando Golang go get. CVE-2018-6574 esta vulnerabilidad afecta al comando go get de Golang y permite a un atacante obtener ejecución de código en un sistema mediante la instalación de una librería maliciosa, esta vulnerabilidad fue corregida en Go...

Malicious code in aseity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...

MAL-2026-17200 Malicious code in aseity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...

MAL-2026-17197 Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

MAL-2026-17195 Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

MAL-2026-17196 Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

Malicious code in donutautosellsrc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...

MAL-2026-17192 Malicious code in donutautosellsrc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...

MAL-2026-17188 Malicious code in sherpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at...

DEBIAN-CVE-2026-96749

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

CVE-2026-96749

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

CVE-2026-96749 Heap out-of-bounds write via signed size overflow in BSON document encoding

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

CVE-2026-96749

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

CVE-2026-96749 Heap out-of-bounds write via signed size overflow in BSON document encoding

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...