Malicious code in Nasrtox (PyPI)

This package is considered malicious because it communicates with an unknown host via a Telegram channel...

Malicious code in tensorfioi (PyPI)

This package is considered malicious because it communicates with an unknown host via a Telegram channel...

Hackers Target Python Developers with Fake "Crytic-Compilers" Package on PyPI

Cybersecurity researchers have discovered a malicious Python package uploaded to the Python Package Index PyPI repository that's designed to deliver an information stealer called Lumma aka LummaC2. The package in question is crytic-compilers, a typosquatted version of a legitimate library named...

Malicious code in reqwestss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b49654324e091538657038a1288d05e2879c02d73bec38baeae681b0a26f5b9 The OpenSSF Package Analysis project identified 'reqwestss' @ 0.1.0 pypi as malicious. It is considered malicious because: - The package...

SUSE: Security Advisory (SUSE-SU-2024:1844-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cybercriminals Abuse Stack Overflow to Promote Malicious Python Package

Cybersecurity researchers have warned of a new malicious Python package that has been discovered in the Python Package Index PyPI repository to facilitate cryptocurrency theft as part of a broader campaign. The package in question is pytoileur, which has been downloaded 316 times as of writing...

Malicious code in discord-react (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bc34a3a31bb6498c18b917bfd0c3049006f5c630220a45dbef402db8ef290775 The OpenSSF Package Analysis project identified 'discord-react' @ 0.0.0.1 pypi as malicious. It is considered malicious because: - The package...

Researchers Uncover Flaws in Python Package for AI Models and PDF.js Used by Firefox

A critical security flaw has been disclosed in the llamacpppython Python package that could be exploited by threat actors to achieve arbitrary code execution. Tracked as CVE-2024-34359 CVSS score: 9.7, the flaw has been codenamed Llama Drama by software supply chain security firm Checkmarx. "If...

AI Python Package Flaw ‘Llama Drama’ Threatens Software Supply Chain

By Waqas The Llama Drama vulnerability in the Llama-cpp-Python package exposes AI models to remote code execution RCE attacks, enabling attackers to steal data. Currently, over 6,000 models are affected by this vulnerability. This is a post from HackRead.com Read the original post: AI Python...

SUSE: Security Advisory (SUSE-SU-2024:1667-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python (EulerOS-SA-2024-1663)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Cybersecurity researchers have identified a malicious Python package that purports to be an offshoot of the popular requests library and has been found concealing a Golang-version of the Sliver command-and-control C2 framework within a PNG image of the project's logo. The package employing this...

Malicious code in multiconnections (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d080fb698cec14d7c79b82bff9f6ca58764dbfcd5b487ea88e5822e59e1d74cb The OpenSSF Package Analysis project identified 'multiconnections' @ 2.34.23 pypi as malicious. It is considered malicious because: - The packag...

AZL-40466 CVE-2024-34069 affecting package python-werkzeug for versions less than 2.3.7-2

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...

Malicious code in threadxpools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41a0be6e9aa8db3965bae9f646d47ad6cb85ac9600c8bd71358409062b8fe105 The OpenSSF Package Analysis project identified 'threadxpools' @ 1.2 pypi as malicious. It is considered malicious because: - The package...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

Malicious code in reqargs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d1ba9bc54763d8ec8336f0edc8d5997d5fb080801556f288a4935dac06d4878 The OpenSSF Package Analysis project identified 'reqargs' @ 1.4 pypi as malicious. It is considered malicious because: - The package communicate...

python3.11-pip bug fix and enhancement update

An update is available for python3.11-pip. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list pip is a package management system used to install and manage software...

Malicious code in sparklog (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa3ac41199a392a32d649e60da4ff9d98d6ceb0d956297d976ce3b5dc948dc91 The OpenSSF Package Analysis project identified 'sparklog' @ 0.0.3 pypi as malicious. It is considered malicious because: - The package executes...

Malicious code in types-for-adobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 927dcbc233169c84ab7ef0e97232782f6bb821d476409cc6ccc8587995dabdc8 The OpenSSF Package Analysis project identified 'types-for-adobe' @ 99.3.9 pypi as malicious. It is considered malicious because: - The package...