1claw-crewai-tools (>=0.1.0, <=0.3.4), 1xn-vmcp (>=0.5.2, <=0.6.1) +1663 more potentially affected by unknown CVE via mcp (>=1.0.0, <=1.29.1)

mcp PYPI version =1.0.0, =0.1.0, =0.5.2, =0.1.1rc0, =0.0.2, =0.2.0, =0.1.0, =0.1.7rc1, =0.1.8rc2 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MCP-20417226...

ROOT-APP-PYPI-CVE-2026-23949 CVE-2026-23949 in jaraco.context - Patched by Root

Root has patched CVE-2026-23949 in the jaraco.context package for Root:PyPI. Multiple fixed versions available...

MAL-2026-17213 Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

5mghost-rover (>=0.0.1, <=0.0.3), a4ui-agent (0.1.0) +420 more potentially affected by unknown CVE via mcp (>=2.0.0, <=2.1.1)

mcp PYPI version =2.0.0, =0.0.1, =0.6.0, =0.1.0, =0.1.0a1, =0.32.1, =0.1.0, =0.21.0, =0.8.0, =0.10.0, =0.21.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0089...

1claw-crewai-tools (>=0.1.0, <=0.3.4), 1xn-vmcp (>=0.5.2, <=0.6.1) +1485 more potentially affected by unknown CVE via mcp (>=1.9.1, <=1.29.1)

mcp PYPI version =1.9.1, =0.1.0, =0.5.2, =0.1.1rc0, =0.0.2, =0.1.0, =0.1.7rc1, =0.1.0, =0.1.0, =0.1.8 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0089...

langchain-utcp (0.1.0), utcp-agent (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-101057 via utcp-mcp (1.0.2)

utcp-mcp PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on utcp-mcp and may be impacted: - langchain-utcp 0.1.0 - utcp-agent =1.0.0, =1.0.3 Source cves: CVE-2026-101057 Source advisory: MEND:CVE-2026-101057...

MAL-2026-17199 Malicious code in scrapetools2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233 scrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways eu.orbitor.dev, dget.top,...

MAL-2026-17200 Malicious code in aseity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...

MAL-2026-17198 Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

MAL-2026-17197 Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

MAL-2026-17195 Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

MAL-2026-17196 Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

MAL-2026-17194 Malicious code in metrics-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60ce93696722d633e9eea7b3fac6f76ebe61a581bd2d1d79efb778f8cb015399 metricssdk 999.0.0 is a dependency-confusion beacon. setup.py runs on pip install and metricssdk/init.py runs on import metricssdk; both hex-encode t...

Malicious code in metrics-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60ce93696722d633e9eea7b3fac6f76ebe61a581bd2d1d79efb778f8cb015399 metricssdk 999.0.0 is a dependency-confusion beacon. setup.py runs on pip install and metricssdk/init.py runs on import metricssdk; both hex-encode t...

MAL-2026-17193 Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...