Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

sloppy-joe

Catch hallucinated, typosquatted, and non-canonical dependencies before they reach production. cargo install sloppy-joe Compromised releases can use a legitimate package name. The LiteLLM maintainer report identifies malicious versions 1.82.7 and 1.82.8 in March 2026. sloppy-joe's default 72-hour...

antisquat

AntiSquat AntiSquat leverages AI techniques such as natural language processing NLP, large language models ChatGPT and more to empower detection of typosquatting and phishing domains. How to use Clone the project via git clone https://github.com/redhuntlabs/antisquat. Install all dependencies by...

of-CORS

of-CORS of-CORS is Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. You can read more here https://trufflesecurity.com/blog/of-CORS How Does it Work?? of-CORS is a Python3 web application built ...

opensquat

openSquat Core 📑 Table of Contents What is openSquat? Featured In Open-Core Model Key Features Quick Start Requirements Usage Premium and API Modes MCP Server Configuration Automation CLI Reference Contributing Author License 🎯 What is openSquat? openSquat is an Open Source Intelligence OSINT...

CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – Malicious PyPI Package Install Hook setup.py Execution Program Code Python setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup name='harmless-pkg', version='1.0',...

go-get-RCE

go-get-RCE This is the exploit of CVE-2018-6574: go get RCE This vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system installing their malicious library. This is a good example of a vulnerability that can be exploited using typosquatting to gain co...

aura

This repository has moved to a new location: https://github.com/SourceCode-AI/aura Security Auditing and code introspection About the problem The current trend in the development is to use a lot of packages in the development phase, even if they provide only trivial functionality and consist of 1...

Malicious code in netweavex (PyPI)

Source: kam193 96ae0ec579e95e33c63930792ee782e6229f77547efac35c3894a7e05c8af2ca Clone of a legitimated package. During import package executes obfuscated code that downloads code from a GitHub repository. During analysis, the code was just a placeholder. --- Category: MALICIOUS - The campaign has...

Malicious code in nebulallm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5428d0f2f07674817697574b1993211dfa902bad746d8cd6efc1ad6b1fbbfd90 nebulallm 1.4.3 presents itself as an AI API client stub but ships a custom install command class in setup.py that executes on pip install. The insta...

Malicious code in aanthropic (PyPI)

Source: kam193 47e89f1629f5ff807eed865fd160d61ba0bb37d1a50f82922f4acd48c52d99e0 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...

Malicious code in 1h1 (PyPI)

Source: kam193 04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...

Malicious code in 1h1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-18188 Malicious code in 1h1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in aanthropic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 47e89f1629f5ff807eed865fd160d61ba0bb37d1a50f82922f4acd48c52d99e0 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-18189 Malicious code in aanthropic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 47e89f1629f5ff807eed865fd160d61ba0bb37d1a50f82922f4acd48c52d99e0 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in semer (PyPI)

Source: kam193 7479f42de6f963e39b7aa1409b586e605dca69978763ab35236d20c9126aa4f1 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...

Malicious code in ssemver (PyPI)

Source: kam193 6aacc4af4fb66d334fa0153d79a707cf0c3decfe3d3b7ed41c67697f21d8b16b During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...

Malicious code in debbug (PyPI)

Source: kam193 082b90f5908b0452f00e213182ddaec147cb8f9c49b25fcb4ec4e1533eafd9ab During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...

Malicious code in deebug (PyPI)

Source: kam193 db7aff856cffe15877311c77e380d51572713e5eaf35aab77ae51453025a352d During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-semvver Reasons based on the campaign: - Downloads...