10286 matches found
MAL-2025-2003 Malicious code in tronwebpy (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-2002 Malicious code in tronpyweb (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-2001 Malicious code in tronpynet (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-2000 Malicious code in tronnetpy (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-1999 Malicious code in tronlinkpy (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-1998 Malicious code in trongridpy (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-1988 Malicious code in ransomware (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-1987 Malicious code in randomuseragent (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-1979 Malicious code in maliciouspkg (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-1967 Malicious code in aurm-python-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-2975 Malicious code in mirage-rce (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f9ba7e438828f3bcacd252bc54f00732b129fe6fc8f6a9909d964720ac1e6420 Setup.py contains a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-02-mirage-rce Reasons...
MAL-2025-2952 Malicious code in ctf-aio-tool (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1641f444ea0056686d1421b67d63c1a6fd944999ed4dff175924de88f1d5182a Installing the package starts a reverse shell. The remote server is, however, set as a local IP, so it's most probably testing --- Category: PROBABLYPENTEST -...
CVE-2025-1716
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package hosted, for example, on pypi.org or GitHub via pip.main. Because pip is not a restricted global, the model, when scanned with picklesca...
CVE-2025-1716 picklescan - Security scanning bypass via 'pip main'
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package hosted, for example, on pypi.org or GitHub via pip.main. Because pip is not a restricted global, the model, when scanned with picklesca...
CVE-2025-1716 picklescan - Security scanning bypass via 'pip main'
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package hosted, for example, on pypi.org or GitHub via pip.main. Because pip is not a restricted global, the model, when scanned with picklesca...
Malicious code in alicloud-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6366aa8c2eff918da0f1cc2118a026e749592f71bebbe81215877575b9593c6a This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...
Malicious code in amzclients-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7918a5aab99f521336ce5a17ca3b3dae77256011f91ed8dc22c4d9a38123f539 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...
Malicious code in enumer-iam (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8062489d0fe9ae58c1937e4afba7f0f3adfbd507e07dd81bb9450bf7f58c6943 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...
Malicious code in time-server-analyzer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 95abdeda4b05cb93bb442d77d1b339498503b1fddb72e3579359f39c5952513b This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...
Malicious code in time-check-server-get (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 25b39f6b89687636c8f9e90e3c326bcfb64ecbfa2594850247d4d2e9646b9257 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...