MAL-2025-1972 Malicious code in envvenuma (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aurm-python-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1966 Malicious code in aurm-desktop-client (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aurm-desktop-client (PyPI)

--- -= Per source details. Do not edit below this line.=-...

openSUSE Security Advisory (SUSE-SU-2025:0756-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in mirage-rce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9ba7e438828f3bcacd252bc54f00732b129fe6fc8f6a9909d964720ac1e6420 Setup.py contains a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-02-mirage-rce Reasons...

Malicious code in marinff-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c25b081dd711bcb5076c5fbd0ea034850b8e428fed345d93e60036e0e91c9f66 Installing the package starts a reverse shell. The remote server is, however, set as a local IP, so it's most probably testing --- Category: PROBABLYPENTEST -...

Malicious code in ctf-aio-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1641f444ea0056686d1421b67d63c1a6fd944999ed4dff175924de88f1d5182a Installing the package starts a reverse shell. The remote server is, however, set as a local IP, so it's most probably testing --- Category: PROBABLYPENTEST -...

MAL-2025-2973 Malicious code in marinff-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c25b081dd711bcb5076c5fbd0ea034850b8e428fed345d93e60036e0e91c9f66 Installing the package starts a reverse shell. The remote server is, however, set as a local IP, so it's most probably testing --- Category: PROBABLYPENTEST -...

Advisory ROSA-SA-2025-2745

Software: python3x-idna 2.10 OS: ROSA Virtualization 3.0 packageevrstring: python3x-idna-2.10-4.rv30 CVE-ID: CVE-2024-3651 BDU-ID: 2024-04211 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the idna.encode function of the Internationalized Domain Names in Applications IDNA is associated with...

MAL-2025-3454 Malicious code in piedefender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f8a30e991bd97073c50a9cdabb10842f2c5ae074c46fcd0aeff5d7917d4b56fa setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals...

Malicious code in piedefender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f8a30e991bd97073c50a9cdabb10842f2c5ae074c46fcd0aeff5d7917d4b56fa setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals...

[SECURITY] Fedora 40 Update: python3.6-3.6.15-43.fc40

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

[SECURITY] Fedora 41 Update: python3.6-3.6.15-43.fc41

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

js2py 0.74 Code Execution

js2py version 0.74 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : js2py versions 0.74 Code Injection Vulnerability | | Author : indoushka | | Teste...

OPENSUSE-SU-2025:14847-1 python311-spotipy-2.25.1-1.1 on GA media

These are all security issues fixed in the python311-spotipy-2.25.1-1.1 package on the GA media of openSUSE Tumbleweed...

PYSEC-2025-18

picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package hosted, for example, on pypi.org or GitHub via pip.main. Because pip is not a restricted global, the model, when scanned with picklesca...

Malicious PyPI Package "automslc" Enables 104K+ Unauthorized Deezer Music Downloads

Cybersecurity researchers have flagged a malicious Python library on the Python Package Index PyPI repository that facilitates unauthorized music downloads from music streaming service Deezer. The package in question is automslc, which has been downloaded over 104,000 times to date. First publish...

picklescan 安全漏洞

picklescan is a security scanning program by the individual developer Matthieu Maitre. A security vulnerability exists in versions of picklescan prior to 0.0.21, which stems from not treating pip as an insecure global variable, which could lead to a malicious model introducing a malicious PyPI...

MAL-2025-2969 Malicious code in kgmicolors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d93708c54253e6772832d4aa1ef7f59e5f4f4c159d5ffaaa4045d8267b15b30 Package contains hidden code that downloads a next stage script, which finally downloads and starts a malware from XWORM family as well as an infostealer ---...