13407 matches found
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...
MAL-2026-10912 Malicious code in shark-e2e-bnsneo (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10910 Malicious code in mysupergoodpython (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10911 Malicious code in mysuperlicense (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10909 Malicious code in ibreak (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10908 Malicious code in hello-world-test-mh3 (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10907 Malicious code in hello-world-test-mh2 (PyPI)
--- -= Per source details. Do not edit below this line.=-...
ROOT-APP-PYPI-CVE-2024-6221 CVE-2024-6221 in rootio-flask-cors - Patched by Root
Root has patched CVE-2024-6221 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34993 CVE-2026-34993 in rootio-aiohttp - Patched by Root
Root has patched CVE-2026-34993 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...
Malicious code in vantrala (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e598f1a12fbd4aed3a98f1942d98fb5ca47182206f0090ac57d7927010061b37 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...
MAL-2026-10867 Malicious code in vantrala (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e598f1a12fbd4aed3a98f1942d98fb5ca47182206f0090ac57d7927010061b37 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...
MAL-2026-10866 Malicious code in nemopush (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 b1717e80fb3423ed246cbcaacb39cfa13526d2f2520a8de1229cd3388e391059 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...
Malicious code in kimichat (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1d4795d0466af3e087dba2ac688463000092f9f4fda9040a4653956a3dc2583a In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...
[SECURITY] Fedora 44 Update: uv-0.11.28-1.fc44
An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...
MAL-2026-10916 Malicious code in python-devplatform-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2b75d4d8e3c822aa82b716e6752c0901447845d442973ce9bc35c78b9c81c78a Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is...
MAL-2026-10771 Malicious code in trongridme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 04117292d543eae5a1d22c78d8a4507cc196c8770c9fb0a09ae2f9a10a8009d4 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
MAL-2026-10770 Malicious code in govpkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc7609ef2380436c805298b1d10362d361ea93b448db92433e3e69cc2de8ed8 Every public API function in govpkg get, package, module invokes a helper named normalizeHelper that downloads an unpinned, unverified binary from th...
Malicious code in trongridev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2db83ccb7d07bdacd1bdf7c32fbaa2a7fb40d7bd599e315f25265ca4bb9d3c03 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...