Malicious code in greater-than (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9287f16baf24f1b5d14e3cdae0ae58d583bcacfa0a19d78c41fc32b3fdce547c When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

MAL-2025-41681 Malicious code in greater-than (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9287f16baf24f1b5d14e3cdae0ae58d583bcacfa0a19d78c41fc32b3fdce547c When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

Malicious code in requires-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa1ee2e2c3ead90338250a60177535b23b5f30016e1d06a5b944092cbc3305e7 When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

MAL-2025-41747 Malicious code in requires-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa1ee2e2c3ead90338250a60177535b23b5f30016e1d06a5b944092cbc3305e7 When imported, the package attempts to exfiltrate environment variables and basic user info --- Category: MALICIOUS - The campaign has clearly malicious intent...

MAL-2025-191881 Malicious code in supersafecalc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e6f4c47c6eaf1976109a771b78c82dbda4409960e11301f85bf120add36b78c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191910 Malicious code in treeherder-submitter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62f372bfa72908a63c289d80e0133c9e6a34732dc8e051ba7be3be89ecc01383 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in treeherder-submitter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62f372bfa72908a63c289d80e0133c9e6a34732dc8e051ba7be3be89ecc01383 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in prof-qux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5b87af8d8f13bd43c1cf3490ea551b8d60fe05a482875597ef2fe5d2c200ca19 Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide...

Malicious code in foundry-jupyter-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8114162af3676e6c75f96e1dc953dae363e41fab4e9b3ce75a84b261aece0113 Installing or importing the module triggers exfiltration of environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-191822 Malicious code in prof-qx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 eb25a7704dc642f82be2ae6a92dcd60cc3235144351fbc18cd11ca96d970c7e3 Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide...

MAL-2025-191820 Malicious code in prof-quotex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a38d66ab1d2bf34456ae2f07cb9600ea89efa8f16c3a48000b70746e5e950f25 Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide...

Malicious code in prof-quotex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a38d66ab1d2bf34456ae2f07cb9600ea89efa8f16c3a48000b70746e5e950f25 Package silently exfiltrates user's credentials ahead of starting the promised functionality. First batch used simple code, the newer attempt to hide...

Malicious code in m5tlprovetomegz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 41041b6e55e23e7b8d40be5bb95a75fdba5b64cb9524c86054deabcd2177e459 Importing the module starts downloading and executing a file recognized as malicious by AVs --- Category: MALICIOUS - The campaign has clearly malicious intent...

MAL-2025-191853 Malicious code in req-ase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6058bfefce274f953708b9c8ba745b15525a3f573da10dac8597285eac526fd4 If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

Malicious code in req-ase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6058bfefce274f953708b9c8ba745b15525a3f573da10dac8597285eac526fd4 If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

openSUSE Security Advisory (SUSE-SU-2025:02460-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2025:15381-1 python311-starlette-0.47.2-1.1 on GA media

These are all security issues fixed in the python311-starlette-0.47.2-1.1 package on the GA media of openSUSE Tumbleweed...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to regular expression DoS and command injection due to the python package (CVE-2024-6232, CVE-2024-9287)

Summary Python is used by DataStage on Cloud Pak for Data as part of data processing functionality. Vulnerability Details CVEID:CVE-2024-6232 DESCRIPTION: There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile...

PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python

Python software development heavily relies on third-party packages. Direct and transitive dependencies create a labyrinth of software supply chains. While it is convenient to reuse code, vulnerabilities within these dependency chains can propagate through dependencies, potentially affecting...

ado-sfttrainer (>=1.0.1, <=1.8.7), aim-mlflow (>=0.1.0, <=0.2.1) +27 more potentially affected by CVE-2025-51464 via aim (>=3.17.4, <=4.0.3)

aim PYPI version =3.17.4, =1.0.1, =0.1.0, =0.1.0, =0.0.1, =4.46.1, =0.0.1, =0.0.3, =0.0.1, =1.1.5, =0.1.1, =0.22.0, =0.0.1, =0.0.1, =2.0.1, =2.0.7 and more Source cves: CVE-2025-51464 Source advisory: SNYK:PYTHON-AIM-10878170...