MAL-2026-15959 Malicious code in @liuliang520500/pdd-sdk-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a7499d71351fb91827b6e69cbea52e9a4cd6b3802693d0b4f1b545700e8ad8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liuliang520500/pdd-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 414eaea31757ec4c7282573b38caddd11b7fd60be46bdebede8224cfa09f8110 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liuliang520500/pdd-sdk-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a7499d71351fb91827b6e69cbea52e9a4cd6b3802693d0b4f1b545700e8ad8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15958 Malicious code in @liuliang520500/pdd-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 414eaea31757ec4c7282573b38caddd11b7fd60be46bdebede8224cfa09f8110 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @liuliang520500/pdd-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @liuliang520500/pdd-sdk-new is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

indexdoc-converter (>=0.2.4, <=0.2.7), pdd-cli (>=0.0.70, <=0.0.250) +2 more potentially affected by CVE-2026-28231 via pillow-heif (>=1.1.0, <=1.2.0)

pillow-heif PYPI version =1.1.0, =0.2.4, =0.0.70, =0.4.0, =0.0.11, =0.0.33 Source cves: CVE-2026-28231 Source advisory: GHSA-5GJJ-6R7V-PH3X...

indexdoc-converter (>=0.2.4, <=0.2.7), pdd-cli (>=0.0.70, <=0.0.250) +2 more potentially affected by CVE-2026-28231 via pillow-heif (>=1.1.0, <=1.2.0)

pillow-heif PYPI version =1.1.0, =0.2.4, =0.0.70, =0.4.0, =0.0.11, =0.0.33 Source cves: CVE-2026-28231 Source advisory: OSV:GHSA-5GJJ-6R7V-PH3X...

pdd-cli (>=0.0.18, <=0.0.21), structured-sql-agent (0.1.0) potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.8)

langchain-anthropic PYPI version 0.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - pdd-cli =0.0.18, =0.0.21 - structured-sql-agent 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2556...

automatedcleaning (>=0.1.2, <=1.4.0), dataset-foundry (>=0.2.0, <=0.5.0) +2 more potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.10)

langchain-anthropic PYPI version 0.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - automatedcleaning =0.1.2, =0.2.0, =0.0.22, =0.0.25 - pyseoanalyzer 2025.4.3 Source cves: CVE-2026-55443 Source advisory:...

ai-parrot (>=0.5.0, <=0.5.17), aiagents4pharma (>=0.0.0, <=1.49.1) +4 more potentially affected by CVE-2026-26013 via langchain-core (0.3.40)

langchain-core PYPI version 0.3.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - ai-parrot =0.5.0, =0.0.0, =0.0.18, =0.0.21 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...

pdd-cli (>=0.0.28, <=0.0.94) potentially affected by CVE-2026-26013 via langchain-core (0.3.56)

langchain-core PYPI version 0.3.56 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - pdd-cli =0.0.28, =0.0.94 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...

pdd-cli (>=0.0.18, <=0.0.21), structured-sql-agent (0.1.0) potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.8)

langchain-anthropic PYPI version 0.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - pdd-cli =0.0.18, =0.0.21 - structured-sql-agent 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

ai-parrot (>=0.5.0, <=0.5.17), aiagents4pharma (>=0.0.0, <=1.49.1) +4 more potentially affected by CVE-2026-34070 via langchain-core (0.3.40)

langchain-core PYPI version 0.3.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - ai-parrot =0.5.0, =0.0.0, =0.0.18, =0.0.21 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

pdd-cli (>=0.0.28, <=0.0.94) potentially affected by CVE-2026-34070 via langchain-core (0.3.56)

langchain-core PYPI version 0.3.56 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - pdd-cli =0.0.28, =0.0.94 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

pdd-cli (>=0.0.28, <=0.0.94) potentially affected by CVE-2026-34070 via langchain-core (0.3.56)

langchain-core PYPI version 0.3.56 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - pdd-cli =0.0.28, =0.0.94 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

ai-parrot (>=0.5.0, <=0.5.17), aiagents4pharma (>=0.0.0, <=1.49.1) +4 more potentially affected by CVE-2026-34070 via langchain-core (0.3.40)

langchain-core PYPI version 0.3.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - ai-parrot =0.5.0, =0.0.0, =0.0.18, =0.0.21 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

pdd-cli (>=0.0.22, <=0.0.25) potentially affected by CVE-2026-28277 via langgraph (0.3.25)

langgraph PYPI version 0.3.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - pdd-cli =0.0.22, =0.0.25 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...

pdd-cli (>=0.0.22, <=0.0.25) potentially affected by CVE-2026-28277 via langgraph (0.3.25)

langgraph PYPI version 0.3.25 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - pdd-cli =0.0.22, =0.0.25 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...

indexdoc-converter (>=0.2.4, <=0.2.7), pdd-cli (>=0.0.70, <=0.0.250) +2 more potentially affected by CVE-2026-28231 via pillow-heif (>=1.1.0, <=1.2.0)

pillow-heif PYPI version =1.1.0, =0.2.4, =0.0.70, =0.4.0, =0.0.11, =0.0.33 Source cves: CVE-2026-28231 Source advisory: SNYK:PYTHON-PILLOWHEIF-15426536...