9321 matches found
Malicious code in sankislayer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 74a2d321c0a35b52bc8ba63b8c13dd8e883d63419ed8aa304b648d3599f98ad8 Obfuscated code provides a Telegram bot to join a spamming botnet. Centrally controlled bots can be used to spam other Telegram channels via looped posting,...
ROOT-APP-PYPI-CVE-2026-47707 CVE-2026-47707 in rootio-strawberry-graphql - Patched by Root
Root has patched CVE-2026-47707 in the rootio-strawberry-graphql package for Root:PyPI. Multiple fixed versions available...
Malicious code in tronsev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 74ab279920219404ed526a79d48c3e9135856fd7905a135ce506c1c148557500 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
MAL-2026-7025 Malicious code in tronsev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 74ab279920219404ed526a79d48c3e9135856fd7905a135ce506c1c148557500 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
Malicious code in tronhapy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9130b2067fa138b1e6562360778bbb48be1679d6de6b170db0c2938f673a1a4b Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
PYSEC-2026-1075 Malicious code in tiktoken-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of tiktoken-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials an...
PYSEC-2026-1074 Malicious code in ray-mcp-server (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of ray-mcp-server were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...
PYSEC-2026-1073 Malicious code in orchestr8-platform (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of orchestr8-platform were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...
Malicious code in openai-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of openai-mcp were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...
Malicious code in mem8 (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of mem8 were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...
PYSEC-2026-1071 Malicious code in mem8 (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of mem8 were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and attemp...
Malicious code in instructor-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of instructor-mcp were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...
PYSEC-2026-1284 Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are...
MAL-2026-7467 Malicious code in scanvia (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in scanvia (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7466 Malicious code in scan-checker (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7465 Malicious code in quatre (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in quatre (PyPI)
--- -= Per source details. Do not edit below this line.=-...