Malicious code in voxcpmui3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9db4ea82be2cd2e2d4d7eb40236b22a9ccd0e0414cad836b98ca63468c4071e The package presents itself as a text-to-speech inference harness but contains no TTS code. On calling the exported Harness.run, the module chmods +x...

Malicious code in echogen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-17462 Malicious code in echogen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-17463 Malicious code in voxcpmtts3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208e19b8b5c2d9ed6169765b2b5985147d0be136e9bb5f83adac6cc691ff4aa5 The package presents itself as a text-to-speech inference library but ships two bundled binaries that implement a cryptojacking payload...

Malicious code in voxcpmtts3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208e19b8b5c2d9ed6169765b2b5985147d0be136e9bb5f83adac6cc691ff4aa5 The package presents itself as a text-to-speech inference library but ships two bundled binaries that implement a cryptojacking payload...

Malicious code in voxel-tts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5 The package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxeltts loads voxeltts/harness.py, which...

MAL-2026-17461 Malicious code in voxel-tts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31bcd85c4464339b45ec445d1c402ecbc97ab4b50b71738d1fc3873c88f9cff5 The package advertises text-to-speech inference but contains no model, audio, or inference code. Importing voxeltts loads voxeltts/harness.py, which...

Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b542a4c53b4c08e104eebfade64c8e91c8d731c4a9bd298e48a258117c5b1bb The package advertises itself as a TTS evaluation harness but ships two large bundled binaries and executes them on the installer's host...

MAL-2026-17457 Malicious code in voxeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b542a4c53b4c08e104eebfade64c8e91c8d731c4a9bd298e48a258117c5b1bb The package advertises itself as a TTS evaluation harness but ships two large bundled binaries and executes them on the installer's host...

abe-bft (1.0.0), adversarial-workflow (>=0.4.0, <=0.9.8) +408 more potentially affected by CVE-2026-104874 via multidict (>=6.7.0, <=6.8.0)

multidict PYPI version =6.7.0, =0.4.0, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =0.1.0, =1.0.5, =25.11.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-104874 Source advisory: SNYK:PYTHON-MULTIDICT-20510280...

3lc (>=2.3.84, <=2.22.0), 3lc-ultralytics (>=0.1.0, <=0.2.1) +2607 more potentially affected by CVE-2026-104851 via fsspec (>=0.9.0, <=2026.4.0)

fsspec PYPI version =0.9.0, =2.3.84, =0.1.0, =0.3.2, =1.1.0, =0.1.0, =0.2.1, =0.1.3, =2.0.0, =0.1.0, =0.0.5a0, =1.3.0, =1.4.1 and more Source cves: CVE-2026-104851 Source advisory: MEND:CVE-2026-104851...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-94636 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-94636 Source advisory: SNYK:PYTHON-THRIFT-20571816...

Malicious code in dedh-devops-automation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-17455 Malicious code in dedh-devops-automation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35e844ac2e44aa325f62eaf6a81e4775c3694320b567f834689e26ac5c961b76 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-66858 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-66858 Source advisory: MEND:CVE-2026-66858...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-66858 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-66858 Source advisory: SNYK:PYTHON-THRIFT-20417194...

agents-schema (>=0.0.8, <=0.0.11), ai-trustgraph (>=0.1.0, <=0.2.2) +244 more potentially affected by CVE-2026-94654 via thrift (>=0.11.0, <=0.24.0)

thrift PYPI version =0.11.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.0, =0.1.1 and more Source cves: CVE-2026-94654 Source advisory: MEND:CVE-2026-94654...

Malicious code in spo365-graph (PyPI)

Source: kam193 ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1 During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then exfiltrated. The malicious code was introduced in version...

Malicious code in shortneer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab The package ships a macOS arm64 Rust-compiled Python extension core.abi3.so fronted by a thin wrapper lb.py. The only exposed Python function,...

MAL-2026-17422 Malicious code in shortneer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab The package ships a macOS arm64 Rust-compiled Python extension core.abi3.so fronted by a thin wrapper lb.py. The only exposed Python function,...