Malicious code in marinff-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c25b081dd711bcb5076c5fbd0ea034850b8e428fed345d93e60036e0e91c9f66 Installing the package starts a reverse shell. The remote server is, however, set as a local IP, so it's most probably testing --- Category: PROBABLYPENTEST -...

MAL-2025-2973 Malicious code in marinff-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c25b081dd711bcb5076c5fbd0ea034850b8e428fed345d93e60036e0e91c9f66 Installing the package starts a reverse shell. The remote server is, however, set as a local IP, so it's most probably testing --- Category: PROBABLYPENTEST -...

Advisory ROSA-SA-2025-2745

Software: python3x-idna 2.10 OS: ROSA Virtualization 3.0 packageevrstring: python3x-idna-2.10-4.rv30 CVE-ID: CVE-2024-3651 BDU-ID: 2024-04211 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the idna.encode function of the Internationalized Domain Names in Applications IDNA is associated with...

MAL-2025-3454 Malicious code in piedefender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f8a30e991bd97073c50a9cdabb10842f2c5ae074c46fcd0aeff5d7917d4b56fa setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals...

Malicious code in piedefender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f8a30e991bd97073c50a9cdabb10842f2c5ae074c46fcd0aeff5d7917d4b56fa setup.py is prepared to download and run an obfuscated batch script. While the script is not detected by any AV currently, in the sandbox analysis it reveals...

[SECURITY] Fedora 40 Update: python3.6-3.6.15-43.fc40

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

[SECURITY] Fedora 41 Update: python3.6-3.6.15-43.fc41

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

js2py 0.74 Code Execution

js2py version 0.74 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : js2py versions 0.74 Code Injection Vulnerability | | Author : indoushka | | Teste...

OPENSUSE-SU-2025:14847-1 python311-spotipy-2.25.1-1.1 on GA media

These are all security issues fixed in the python311-spotipy-2.25.1-1.1 package on the GA media of openSUSE Tumbleweed...

PYSEC-2025-18

picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package hosted, for example, on pypi.org or GitHub via pip.main. Because pip is not a restricted global, the model, when scanned with picklesca...

Malicious PyPI Package "automslc" Enables 104K+ Unauthorized Deezer Music Downloads

Cybersecurity researchers have flagged a malicious Python library on the Python Package Index PyPI repository that facilitates unauthorized music downloads from music streaming service Deezer. The package in question is automslc, which has been downloaded over 104,000 times to date. First publish...

picklescan 安全漏洞

picklescan is a security scanning program by the individual developer Matthieu Maitre. A security vulnerability exists in versions of picklescan prior to 0.0.21, which stems from not treating pip as an insecure global variable, which could lead to a malicious model introducing a malicious PyPI...

Malicious code in kgmicolors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d93708c54253e6772832d4aa1ef7f59e5f4f4c159d5ffaaa4045d8267b15b30 Package contains hidden code that downloads a next stage script, which finally downloads and starts a malware from XWORM family as well as an infostealer ---...

MAL-2025-2969 Malicious code in kgmicolors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d93708c54253e6772832d4aa1ef7f59e5f4f4c159d5ffaaa4045d8267b15b30 Package contains hidden code that downloads a next stage script, which finally downloads and starts a malware from XWORM family as well as an infostealer ---...

Malicious code in alicloud-client-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 59563b61e548ff83488a4940e0511825ebf1a2d0995c83e0056e07fd7a4bd782 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

Malicious code in tclients-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e1b954f34e0b9f14cca18b47f856a049c06e3503f3186ec2ae4db717a1298a8 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

Malicious code in time-server-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8a160dff2a937ad50482cc2b8c8bcd1b7e7c37aefb584bd26515edfecdd4052f This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

Malicious code in time-service-checker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 92ae5fc73fd7cc45d02ba02f6c3b667d155f681ba74262d66421edee5f19d237 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

Malicious code in tcloud-python-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 221affa8a84428ae21f288ce299d114742d269e7bbcbf223a0aa666327fae2c4 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

Malicious code in serverkeeper-verifier (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62ec235d314e175928f82504dade8d7f8313bc88707038976e5be6d78709b869 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...