MAL-2025-41687 Malicious code in iamenumer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2281f18809744cd511d94170c1ce172994a633aa0b8b5bc9fa9b892629b5d674 Before creating the boto3 client, package exfiltrates user's credentials. Packages from the campaign are used as dependency in a GitHub project promising...

Malicious code in iamenumer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2281f18809744cd511d94170c1ce172994a633aa0b8b5bc9fa9b892629b5d674 Before creating the boto3 client, package exfiltrates user's credentials. Packages from the campaign are used as dependency in a GitHub project promising...

Malicious code in aws-enumerate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82e411db1ea78935340bd950942b13579b400264ddef042aa0b07d6952401c45 Package for enumeratin IAM --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-aws-enumerate Reasons base...

MAL-2025-41621 Malicious code in aws-enumerate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82e411db1ea78935340bd950942b13579b400264ddef042aa0b07d6952401c45 Package for enumeratin IAM --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-aws-enumerate Reasons base...

MAL-2025-191774 Malicious code in kertash (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3cb3ef6da7e0d1c1461bb944c5ff0e356b73e52d271afa9e94435097f1d0764f When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used ...

Malicious code in flask-tdg-cyber (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec9e25f8f416bf20ca51977e1d4e001cf398d79dee777ff3b12b04cab6345292 Package is prepared for exfiltration of detailed data about the running system. The exact behaviour depends on the version: some does nothing, some exfiltrate...

decima2 (>=0.1.0 <=0.2.1), gpbench (>=1.0.3 <=1.2.2) +8 more potentially affected by CVE-2025-8747 via keras (>=3.0.0 <=3.10.0)

keras PYPI version =3.0.0, =0.1.0, =1.0.3, =0.0.28, =2.4.0, =0.1.0, =0.1.1, =1.1.0, =1.0.0, =1.2.0 Source cves: CVE-2025-8747 Source advisory: SNYK:PYTHON-KERAS-11775502...

MAL-2025-191911 Malicious code in tronapihelper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8668b25d81460ff9ac1973c8f9ad6e6092350a4a08d6a4b5ba1fc827a553dc38 Package is prepared to exfiltrate private keys, most probably for Tron cryptocurrency. There is no other purpose of the package --- Category: MALICIOUS - The...

Malicious code in permsupping (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2dec8af74032aa8a44855e36075b08f5a83aef64962e2c6604e6ecb0b288aa10 Package is prepared to exfiltrate private keys, most probably for Tron cryptocurrency. There is no other purpose of the package --- Category: MALICIOUS - The...

SUSE CVE-2025-54368

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with...

MAL-2025-191923 Malicious code in w3shi-h1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 47a1a62947736a51ca9d7d239d8533828679c6e1597205b6316ee4a9af95a41a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in packed-w3shi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3d670904891ef361ef283e3f218f21b6e3758847277e8bccb0dbecd08b08971a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2025-54368

CVE-2025-54368 affects uv (Python package/project manager) up to v0.8.5, where remote ZIPs are parsed streaming-wise and archive entries aren’t reconciled with the central directory. An attacker could craft a ZIP that yields legitimate contents for some installers but malicious contents for other...

CVE-2025-54368 uv is vulnerable to ZIP payload obfuscation through parsing differentials

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with...

Astral-sh uv 安全漏洞

Astral-sh uv is a Python package management tool from Astral. A security vulnerability exists in Astral-sh uv version 0.8.5 and earlier, which stems from improper handling of ZIP archives and could lead to malicious code execution...

Malicious code in raknet-testing-package2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d26ae7cefa4b8ebaf16a44f6d3c42c1fd6dbacda884e5b03b06da5ff237d7435 During installation, the package attempts to install the own MITM proxy without user's consent and hijack all requests --- Category: MALICIOUS - The campaign h...

MAL-2025-41730 Malicious code in raknet-testing-package2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d26ae7cefa4b8ebaf16a44f6d3c42c1fd6dbacda884e5b03b06da5ff237d7435 During installation, the package attempts to install the own MITM proxy without user's consent and hijack all requests --- Category: MALICIOUS - The campaign h...

MAL-2025-41729 Malicious code in raknet-testing-package (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9f558ab07d5858b728bc43a5a17c5eff73b0413f2d871ac3bc33b1b8c30a6ef5 During installation, the package attempts to install the own MITM proxy without user's consent and hijack all requests --- Category: MALICIOUS - The campaign h...

Malicious code in raknet-testing-package (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9f558ab07d5858b728bc43a5a17c5eff73b0413f2d871ac3bc33b1b8c30a6ef5 During installation, the package attempts to install the own MITM proxy without user's consent and hijack all requests --- Category: MALICIOUS - The campaign h...

openSUSE Security Advisory (SUSE-SU-2025:02701-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...