fabric

|version| |python| |license| |ci| |coverage| .. |version| image:: https://img.shields.io/pypi/v/fabric :target: https://pypi.org/project/fabric/ :alt: PyPI - Package Version .. |python| image:: https://img.shields.io/pypi/pyversions/fabric :target: https://pypi.org/project/fabric/ :alt: PyPI -...

Malicious code in qzc690384 (PyPI)

Source: kam193 dbd73fb476a20a6d0f4bc4fe820a007283789e6c03548f93e67fff7a58b2ede1 In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remo...

MAL-2026-18752 Malicious code in qzc690384 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aaf64364e0f3a5688772d501b9400cd9caf65ecdc82a869844ff73999aff2e4 The adjudication model's output was cut off by the provider safety filter on every attempt, which happens when the reviewed code reads like operation...

Malicious code in extera-plugin-runtime (PyPI)

Source: kam193 b13320bcb71932e051e8e2a8fbd98f3e8faadae85f0ae60ca2f1c2cf8d827829 The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in extera-runtime (PyPI)

Source: kam193 400bf2ff64fec2a3d26fa477d19f25b0d2abfdc40ae5247531a128cfdc41aa19 The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2026-18633 Malicious code in extera-runtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af4f783a1272f2f3b0596fd936a58e19320e6cb2c3fe05e523b8c989eb37b67d extera-runtime 1.1.0 ships a BackupRuntime class that, when instantiated and started, launches a daemon thread polling a hardcoded endpoint...

Malicious code in extera-runtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af4f783a1272f2f3b0596fd936a58e19320e6cb2c3fe05e523b8c989eb37b67d extera-runtime 1.1.0 ships a BackupRuntime class that, when instantiated and started, launches a daemon thread polling a hardcoded endpoint...

Malicious code in numprint (PyPI)

Source: kam193 ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243 During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-18343 Malicious code in numprint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint hardcoded C2, credential...

Malicious code in numprint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint hardcoded C2, credential...

Malicious code in qowa (PyPI)

Source: kam193 67fe6a2b86c60720a8e3cc1002c183bd751ec1896d3be13a44b5ce7d1623afbd The package provides a C2 server and agent with pre-filed credentials, disguised as a generic utility. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-qowa...

MAL-2026-18218 Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5 src/qowa/init.py contains calls to socket.gethostname at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints...

Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5 src/qowa/init.py contains calls to socket.gethostname at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints...

PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

TeamUpdraft has disclosed unauthorized access to itsteamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer...

PT-2026-116245

Уязвимость функции check remote commands платформы для мониторинга безопасности и обнаружения угроз Wazuh связана с недостатками механизма обработки регистрозависимых данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с правами root...

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2...

Malicious code in beautifytext (PyPI)

Source: kam193 cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b During import, the package silently spans a separate process that waits for and executes remote commands. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-17417 Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

CVE-2026-88285 GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands...