Malicious code in pystr-codec (PyPI)

Source: kam193 9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1 Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting...

Malicious code in pystr-codec (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1 Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a...

CVE-2024-3400

CVE-2024-3400 import os,base64,time systempth = "/usr/lib/python3.6/site-packages/system.pth" with opensystempth,'wb' as f: f.writeb'''import...

Malicious code in security-research-startup-snapshot-810764b303 (PyPI)

Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a loca...

Malicious code in research-probe-6150c1c915 (PyPI)

Source: kam193 a646eaf4fe72ba013abc53d52c0bf017a9c4f3bfc54a8c358f9f246d3ac41945 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a loca...

MAL-2026-18098 Malicious code in security-research-startup-snapshot-810764b303 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on...

Malicious code in security-research-startup-snapshot-810764b303 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on...

MAL-2026-18097 Malicious code in research-probe-6150c1c915 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3696b3aaa62ad07c027d3471a6061628fe63f07faa135887342362ceb424e604 The package ships a .pth file that imports researchprobe6150c1c915.boot on every Python interpreter startup, with no explicit import by the user...

Malicious code in research-probe-6150c1c915 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3696b3aaa62ad07c027d3471a6061628fe63f07faa135887342362ceb424e604 The package ships a .pth file that imports researchprobe6150c1c915.boot on every Python interpreter startup, with no explicit import by the user...

MAL-2026-18094 Malicious code in pafex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f048e6c59bed3c95094e9baaf28b7234a917300b81a4c81db0eb0a3f859ff4e3 No install-time or import-time network I/O, credential access, subprocess execution, or other installer-harm behavior was observed in this package...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314: Path Traversal: '../filedir'

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

PT-2026-104748

Name of the Vulnerable Software and Affected Versions Papermerge version 3.5.3 Description A standard user can achieve remote code execution through a directory traversal flaw in the '/api/documents/upload' endpoint. This allows an attacker to write a Python .pth file into the site-packages...

Malicious code in platform-telemetry-client (PyPI)

Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS records. During analysis, the intended domain was not yet...

Malicious code in openaii (PyPI)

Source: kam193 c49a2850cfc08dc68cdbe8204e265de6609b56c46ebfa9f5e211a09421e79120 Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive...

Malicious code in transfomers (PyPI)

Source: kam193 c6a3963d4a040c2ab6bfcd6a41395bc60c6b5755420157c053b9b88d9befec9a Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive...

Malicious code in langgrap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380 Package name langgrap is a one-character deletion of langgraph, and init.py re-exports from langgraph import so imports appear to succeed. The...