Malicious code in websocket-clientt (PyPI)

Source: checkmarx 33cf4131351db40feeeab46a20ef29dbf2694a7cfbaf07b5927603a5dd8e4f03 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clieent (PyPI)

Source: checkmarx 4feae31dcf666a30e8848da752d72614ca03bd3c60eedb2f69a4de43eb9f7560 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clint (PyPI)

Source: checkmarx e2ed5b9c8a0271395a5e0407624dd18f8b28071aee5588b73ad595d0d126499a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cllient (PyPI)

Source: checkmarx db7751b36861392ace123440141ea620167cf864cb8690f562a26d303f21245e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clietn (PyPI)

Source: checkmarx 81783882612ba7b6fae545c40b498a476222def4eab8e8b779ff41cefcb93e3d Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cclient (PyPI)

Source: checkmarx 3200072ca23fb3f9d041940f3e7bb0306e92c438c53c2d08cbb020c7879f835c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cliet (PyPI)

Source: checkmarx 06412b694edd65cdb47e2702e6629ceb27ac0ab4d17846860a687a380d14c94c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cleint (PyPI)

Source: checkmarx b95022cf171781e9a5b50900b78390fa8ba1d016e8c2e34ff9e7fbf2d900ceed Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-lcient (PyPI)

Source: checkmarx 06fe78dfaf7de4fc0f3b80d29f70f2adfac22a5446be0781ebadd88b23a66f2f Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clien (PyPI)

Source: checkmarx fdd107331bf3e46620076f654463266a9f8f024454379ef04288aba0e0af540c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-lient (PyPI)

Source: checkmarx 167f66c15160a1a310640f5863b0995a3a49c8e139d6c2e2995e15ad3df705cf Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clinet (PyPI)

Source: checkmarx 6638db5357088a77a9ccb3e2f2754c8ba7c10746f703e3ae4b586548318faeef Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cliennt (PyPI)

Source: checkmarx ce81626c97864e772e307901ca4c296db0ea985a4296d6d5c910615cc6b94efa Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cient (PyPI)

Source: checkmarx ac94b737cfa799516c0c831332c0d3406bf24089725787a5a884703605f8af9a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ryry-cli (PyPI)

Source: amazon-inspector 4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts under subprocess.Popen based on task messages sent by that...

Malicious code in helmet-fastapi (PyPI)

Source: kam193 c1f805932ecbcd95197e98c6e2336eb773252abf5615fe135076d1848cb90395 Package contains hidden code adding a backdoor - a WebSocket path handler which will execute commands sent by an attacker knowing the path. In addition, it adds a log handler to remove related access logs. --- Categor...

Malicious code in darkglitch (PyPI)

Source: amazon-inspector 6d02eb8be388433532783a7bf88864824b50756b7ced4f8728721866740c5df1 darkglitch 1.2.0 ships a listener mode -l -c that opens a WebSocket connection to the hardcoded signaling host https://malware-signal.vercel.app/ and joins the fixed room D4RKGLI7CH. Incoming remote-command...

PT-2026-66890

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

PT-2026-63317

Name of the Vulnerable Software and Affected Versions websocket-driver versions prior to 0.8.2 Description Remote clients can crash a TCP-backed WebSocket server by sending a malformed Host header. The WebSocket::Driver.server method passes this header to URI.parse in the...

PT-2026-63240

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...