The khoj application has an unauthenticated path traversal vulnerability in its /home/{file_path:path} endpoint. This endpoint serves static files by concatenating user input directly with a home directory path without any path traversal filtering, normalization, or authentication. An attacker can exploit this to read arbitrary files from the server filesystem, including sensitive configuration and system files.
The sherpy package on PyPI is a malicious tool disguised as an OSINT command-line utility. It contains a large precompiled native module that performs stealthy exfiltration of sensitive user data, including wallet keystores and Telegram files, to an attacker-controlled Telegram bot. The malicious behavior is hidden inside a compiled binary with no source code, preventing easy detection through source review. The package versions 0.1.0 and 0.1.1 are affected.
SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.
The 'reqparser' package on PyPI versions 1.0.0 and 1.0.1 is identified as malicious software. It acts as an infostealer that exfiltrates data from cryptocurrency wallets and web browsers, establishes persistence, installs additional malware, and includes keylogging functionality. The package also detects sandbox environments to evade analysis.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22)
setup.py registers a custom install command (PostInstallCommand) that runs my_private_pkg/index.py automatically on `pip install`. That script gathers installer-side identifiers — os.getlogin(), socket.gethostname(), local IP address, os.getcwd(), platform.system() and platform.machine() — and POSTs them as JSON to a hardcoded collector URL at https://webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed. A duplicate of the exfiltration payload is shipped as vercel_runtime_python/index.py, and vercel_runtime_python/__init__.py contains the same PostInstallCommand wiring referencing my_private_pkg/index.py; the module name mimics Vercel's Python runtime. The package name and the internal vercel_runtime_python module name are consistent with a dependency-confusion lure targeting an internal `my-private-pkg` name and Vercel's runtime namespace: the only on-install effect is a reconnaissance beacon to an attacker-controlled webhook.site endpoint identifying the host that mistakenly resolved the public name.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6)
The package presents itself as a Vercel Python runtime helper but ships no runtime functionality. Its only substantive code path is a public function send_info() that gathers hostname, resolved IP, operating system, and machine architecture via get_device_info() and POSTs the result as JSON to the hardcoded URL https://webhook.site/f9bff304-3053-4d54-be05-86537267514a. The destination is not caller-configurable, is not documented, and is not associated with Vercel. Any consumer that invokes the advertised API silently discloses host reconnaissance data to an attacker-controlled webhook.site inbox. The typosquat-shaped name (mimicking an official Vercel component) combined with a module surface consisting solely of host-info collection and outbound POST is consistent with reconnaissance-oriented installer targeting rather than a legitimate runtime library.
## Source: kam193 (5bd13c006fe4fbaf8bb81d068f6e3c822ea1e664b24d0045370aead862ccd06f)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cb2bf0fd5f445eed9825601f2b4497502054176d106d4fecb9eabf38312dd582)
prosocks 1.0.25 enrolls the installer's host as a remote-controlled SOCKS5 exit node under a hardcoded control plane at https://kalnetz.store. setup.py's custom install command writes prosocks.bat into the Windows Startup folder (establishing boot persistence) with the command '"{python_exe}" -m prosocks https://kalnetz.store' and immediately spawns that process during `pip install`. The top-level module additionally calls _auto_launch() so that any `import prosocks` spawns a detached subprocess running the same agent. Once running, ProSocksAgent.register() queries ip-api.com and api.ipify.org for the host's public IP, generates an agent_id and proxy password, and POSTs agent_id, hostname, public IP, proxy port, and password to https://kalnetz.store/api/register, then binds a SOCKS5 server on 0.0.0.0:9050 accessible from any network the host can reach. Heartbeat and bandwidth telemetry are POSTed to /api/heartbeat and /api/bandwidth, and IP changes trigger re-registration. All requests to the panel and IP-lookup services are made with TLS verification disabled (verify=False). The combination of install-time execution, import-time execution, Windows Startup persistence, hardcoded non-first-party control plane, and an unauthenticated SOCKS5 listener on all interfaces whose credentials are handed to that control plane matches a proxyware/botnet backdoor.
## Source: kam193 (a1ca37b881f19975a8ab8b23bd5e69b51355333374385aabfc5784b69bf95545)
The package automatically joins the machine to a proxy network. Depending on the version, it can happen during the package installation or when importing the module.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-prosocks
Reasons (based on the campaign):
- other
- peristence-autorun
- persistence
A denial of service vulnerability exists in plone.app.contenttypes when uploading files or images with excessively long filenames. This can cause Plone to become unresponsive and make the UI difficult to use for editing or deleting the content. The issue has been patched in specific versions of plone.app.contenttypes and related fixes are available in plone.app.dexterity. No workarounds are known.
A malicious version 2.0.34 of the MemoryOS Python package on PyPI was published containing a Go-based implant named sckit. This implant runs a background binary that collects various credential files from the user's home directory and exfiltrates them to attacker-controlled servers under skyleen.fr. It also includes functionality to propagate itself into other repositories and packages accessible with the stolen credentials. The implant uses encrypted communication with its command-and-control servers and deletes itself after execution. Additionally, the package's build backend can steal CI environment publishing tokens, enabling further compromise of downstream package publishing.
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.
The pullgetsage package on PyPI contains malicious code that exfiltrates Telegram Desktop session data. Upon import, it archives the Telegram Desktop 'tdata' directory, which holds session keys, and sends it to a hardcoded external endpoint. This enables full account takeover of the installer's Telegram account. The malicious behavior is disguised with misleading identifiers and silent error handling. The package falsely claims to be a library filled with books, unrelated to Telegram functionality.
The starlette-healthchecks package on PyPI is identified as a malicious typosquatting attempt. It offers minimal legitimate functionality but primarily performs telemetry calls, indicating malicious intent. A similar package named starlette-healthcheck was recently removed from PyPI. This campaign is categorized as malicious due to its intent to deceive users and potentially collect unauthorized data.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (f98f9dd8cd5b70474786eb054bccf9de05d98face434e0a814123e51c090f364)
During installation and after generating a healthcheck report, package sends opt-out telemetry. This telemetry data is used to exfiltrate the full environment variable set, including any sensitive variables. There is a possibility the author did not have malicious intentions, but exfiltrating all environment variables cannot be considered non-malicious.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-py-venv-doctor
Reasons (based on the campaign):
- The package overrides the install command in setup.py to execute malicious code during installation.
- exfiltration-env-variables
- action-hidden-in-lib-usage
Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. The server accepted any well-formed token regardless of the signature, including tokens with alg: none and tokens signed with the wrong key. The fix in v3.10.1 replaces the broken decode with a from-scratch HS256 verifier using only the Python standard library. For users who cannot upgrade immediately, restrict network access to the sync server endpoint to trusted clients only. Firewall, reverse proxy with mTLS, or localhost bind with SSH tunnel are all viable. The vulnerability is not exploitable against an unreachable endpoint.
CVE-2026-85999 is a medium severity vulnerability in the Python library soupsieve (used by BeautifulSoup) that causes uncontrolled resource consumption (quadratic time complexity) when parsing certain valid CSS selectors containing long runs of whitespace or comments. This happens due to an inefficient regular expression search that triggers excessive backtracking, leading to significant CPU usage and interpreter stalls. The issue affects soupsieve versions prior to 2.9. Exploitation requires user-controlled CSS selectors, so applications using only hard-coded selectors are not affected.
CVE-2026-86000 is a medium severity vulnerability in the Python library soupsieve (used by BeautifulSoup) involving uncontrolled resource consumption due to a regular expression backtracking issue. The flaw arises from overlapping quantified character classes in the regex pattern used to parse CSS selectors, causing quadratic time complexity when processing certain crafted selectors that fail to match. This can lead to significant CPU consumption and delays when user-controlled selectors are processed. The vulnerability affects soupsieve versions prior to 2.9. Exploitation requires passing a maliciously crafted CSS selector string to soupsieve or BeautifulSoup's select methods. No known exploits are reported in the wild, and no official patch information is provided in the input data.
The PyPI package 'requests-asetwe' version 2.34.2 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-harm package resembling pentest or testing tools but with unauthorized data exfiltration functionality.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (4b837b7b56f9b239c9d0c86bd2e7d432d3223e496a9820c54b0a14fd3c542b22)
The package was found to contain malicious code or consuming dependency that contains malicious code
## Source: kam193 (7561fd94425cdde34f5f9f3d20482a0da8680414d0f38e1e00fea419ce23cf66)
The package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-pyjstat-smooth
Reasons (based on the campaign):
- files-exfiltration
- obfuscation
- targetted-attack
- clones-real-package
The pyjstat-smooth package on PyPI contains malicious code designed to exfiltrate specific files from a user's machine. The file paths targeted suggest the malware was intended for use in a Capture The Flag (CTF)-like environment. This package is a clone of a legitimate package but includes obfuscated code with clear malicious intent to steal information.
Jupyter Server versions prior to 2.21.0 contain a vulnerability where the Referer header is logged without scrubbing sensitive tokens during 5xx error responses. This can lead to sensitive tokens being stored in plaintext in server logs. An attacker with access to these logs could recover tokens and gain the affected user's permissions. The issue is fixed in version 2.21.0.