10588 matches found
Malicious code in minecraftmodes (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2057275d7d6bc39e22d9147702d20b43fcabcab4e438821e823010937448eb6c The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...
MAL-2026-15936 Malicious code in trongridew (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...
Malicious code in trongridew (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...
CVE-2018-11784
γγγΈ γ©γ€γ»γ³γΉ MIT γ€γ³γΉγγΌγ«...
CVE-2023-29489
γγγΈ γ©γ€γ»γ³γΉ MIT γ€γ³γΉγγΌγ«...
Malicious code in proxycer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2286dac5be0a9e8cc2e7b1ff92253d4b09beb0c43d5e795b9b9ea1391e6f8764 The package's top-level init.py imports starts.py, which is a single-line loader that reverses a 100KB string literal, base64-decodes it, marshal.loa...
MAL-2026-15935 Malicious code in proxycer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2286dac5be0a9e8cc2e7b1ff92253d4b09beb0c43d5e795b9b9ea1391e6f8764 The package's top-level init.py imports starts.py, which is a single-line loader that reverses a 100KB string literal, base64-decodes it, marshal.loa...
Malicious code in dbt-sa-cli (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a setup.py defines rcepoc and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects...
MAL-2026-15934 Malicious code in dbt-sa-cli (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a setup.py defines rcepoc and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects...
Malicious code in houdus (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f1c6df3b6cf8e44eceecfcd1aa44ee0301e8921b0c5294560c0031c0b17b6e6 The package advertises random-number helpers but its generator.py side-loads houdus/assests/ssd.wav as Python via importlib.util.specfromfilelocation...
safe-chain v1.5.16
Aikido Safe Chain β Block malware on developer laptops and CI/CD β Supports npm and PyPI more package managers coming β Blocks packages newer than 48 hours without breaking your build β Tokenless, free, no build data shared Need protection beyond npm & PyPI? Aikido Device Protection builds on Saf...
Malicious code in metricboxlite (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...
MAL-2026-15931 Malicious code in metricboxlite (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...
Malicious code in olympuslib (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdcee7d29dcf5e9c04cc3528403c15c3359c6701eaf42f54ecaa2ac4c29a4b3c Top-level init.py invokes a canary routine on import that serializes the entire os.environ dictionary along with socket.gethostname and package...
MAL-2026-15928 Malicious code in olympuslib (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdcee7d29dcf5e9c04cc3528403c15c3359c6701eaf42f54ecaa2ac4c29a4b3c Top-level init.py invokes a canary routine on import that serializes the entire os.environ dictionary along with socket.gethostname and package...
MAL-2026-15929 Malicious code in pymaas (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d07b21485fb1007b5cca6c07b48620d235200b19dd62e8d6018d019ec5557dc On import pymaas, top-level code in the package invokes a canary function that collects the entire os.environ dictionary and socket.gethostname,...
Malicious code in pymaas (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d07b21485fb1007b5cca6c07b48620d235200b19dd62e8d6018d019ec5557dc On import pymaas, top-level code in the package invokes a canary function that collects the entire os.environ dictionary and socket.gethostname,...
Malicious code in tpu-raiden-jax (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37dbb20f91d6812bd5bcfa84a040595ea1f9358e56f946da4efa599f7751bed On first import, tpu-raiden-jax's top-level init.py invokes a canary routine that serializes the entire os.environ dictionary along with...
MAL-2026-15930 Malicious code in tpu-raiden-jax (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37dbb20f91d6812bd5bcfa84a040595ea1f9358e56f946da4efa599f7751bed On first import, tpu-raiden-jax's top-level init.py invokes a canary routine that serializes the entire os.environ dictionary along with...
Malicious code in qoeoe (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e6c0c50dfb4a99c6e8b2ca640cadd33877e737479d8739d5db5b39271bc967 The package ships a single module qoeoe/starts.py whose entire body is a lambda that base64-decodes a reversed 108 KB string literal and passes the...