NLTK versions prior to 3.10.4 contain a file sandbox bypass vulnerability in several model-artifact APIs. These APIs improperly handle caller-controlled model paths by using raw file operations instead of pathsec-aware helpers, allowing reading and writing of files outside the intended sandbox directories. This bypass undermines pathsec enforcement, potentially enabling unauthorized file access or modification. A fix is available in version 3.10.4.
Apache Spark History Server versions prior to 3.5.8 have a stored cross-site scripting (XSS) vulnerability due to lack of proper escaping of application names. This flaw allows a malicious Spark job to inject arbitrary unescaped frontend code, potentially causing minimal privilege escalation in a user's browser. Exploitation requires the ability to launch a Spark job and trick a user with higher privileges to visit the Spark History Server web page. The issue is fixed in version 3.5.8.
The syswatch package on PyPI version 1.0.0 contains malicious code that, when imported on Windows systems, silently downloads and executes a remote executable disguised as a system utility. This executable is a heavily obfuscated malware known as "Snow Stealer" that performs sandbox evasion, steals browser data, and targets cryptocurrency wallet applications. The package disables TLS verification when fetching payloads and erases Windows event logs to cover its tracks. The malicious behavior is not disclosed by the package, which falsely advertises itself as a system-monitoring library.
CVE-2026-84309 is a medium severity vulnerability in the py-pdf pypdf library prior to version 6.16.0. It involves an infinite loop caused by a crafted PDF with a cyclic tree structure that triggers the TreeObject.insert_child function to follow /Next links indefinitely. This issue is resolved in pypdf version 6.16.0.
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times, creating exponentially many traversal paths and causing long runtimes and large memory consumption. This issue is fixed in version 6.16.1.
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.
The gcphelpit PyPI package versions 0.1.0, 0.1.1, and 0.1.2 contain malicious code that exfiltrates sensitive user files. Specifically, the package reads the installer's ~/.zshrc file, which often contains cloud credentials and access tokens, and sends this data to a third-party public webhook. This exfiltration occurs unconditionally on every CLI invocation, posing a significant risk of credential theft. Prior to version 0.1.2, the package executed a harmless proof-of-concept action instead of exfiltrating data.
The tallyboxlite package on PyPI version 1.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It has no legitimate functionality beyond this data exfiltration.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859)
The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx `to` field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached `spawn('node', ['-e', <code>])`. Execution is wired to two auto-triggers: pyproject.toml overrides setuptools `build_py` and `develop` with pyservercheck._setup_cmd.BuildPy/Develop, whose `run()` calls _run_main_js_now() -> subprocess.run(['node', main.js]) during `pip install` / `pip install -e.`; and BuildPy also writes a `pyservercheck.pth` file containing `import pyservercheck._hooks; pyservercheck._hooks.ensure_once()`, which Python auto-executes at every interpreter startup, invoking run_js() again. The `.main_js_ran` marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run.
## Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a)
Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.
The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pybitjs
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- malware
- abuses-pth
- c2-in-blockchain
The PyPI package 'tronlinker' version 0.0.1 is identified as malicious software designed to exfiltrate private keys. It appears related to the cryptocurrency Tron (TRX) ecosystem. The package may impersonate legitimate libraries by cloning their readme files and has been repeatedly uploaded to PyPI under similar names. There are no known reports of active exploitation in the wild at this time.
The auth-app-streamlit package version 2.1.1 on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration. No official patch or remediation guidance is currently available.
The PyPI package 'trongridor' version 0.0.1 is identified as malicious software designed for private key exfiltration, likely targeting cryptocurrency assets related to Tron (TRX). The package mimics legitimate libraries by cloning their readme files and has been repeatedly uploaded to PyPI under similar names. There are no known active exploitations in the wild at this time.
The flask-header-guard package on PyPI (version 1.0.0) is a malicious package masquerading as Flask security-headers middleware. It executes hostile code during installation and when imported, including exfiltration of sensitive environment variables and system files, establishing persistence via a reverse shell, local privilege escalation, and an unauthenticated remote code execution backdoor in Flask apps.
AIIR versions prior to 1.7.0 contain verification and policy gates that could incorrectly report success without enforcing the intended security controls, effectively failing open. This could cause consumers relying on these gates to treat unsigned, forged, or non-conforming inputs as verified. The issue affects multiple verification paths including signing requirements, CI verification, release policy enforcement, and signature verification. The problem is fixed in version 1.7.0, which enforces fail-closed behavior with regression tests. No workarounds exist other than upgrading. The vulnerability does not forge valid signatures or compromise cryptographic guarantees but may cause false verification results.
CVE-2026-55247 is a critical vulnerability in plone.app.event, a Plone event content type. Versions prior to 5.2.4 and 6.0.1 allow a logged-in editor to exploit insufficient restrictions on iCalendar import URLs, leading to uncontrolled resource consumption and potential denial of service. The flaw also permits storing malicious event URLs that can execute scripts in other users' browsers. The issue is fixed in versions 5.2.4 and 6.0.1 by restricting URLs, limiting import size and event count, using transaction savepoints, and validating URLs.
The yamlformat-tools package version 0.1.0 on PyPI contains malicious code that collects sensitive information during import and exfiltrates it via DNS queries. This behavior classifies it as a malicious package with intent to steal information and credentials. No patch or remediation guidance is provided. There is no evidence of known exploits in the wild at this time.
The yamlformatter-utils package version 1.0.0 on PyPI contains malicious code that collects sensitive information during import and exfiltrates it via DNS queries. This behavior classifies it as a malicious package with intent to steal information and credentials. There is no CVSS score available for this threat. No official patch or remediation guidance is provided in the source data.
The pygame-renderkit package version 1.2.0 on PyPI contains malicious code embedded in its setup.py. During installation, it executes a base64-encoded payload that establishes a reverse shell to a hardcoded command-and-control server, exfiltrates sensitive environment variables and system files, and establishes persistence through cron jobs, systemd user services, and sudoers modifications. This behavior is unrelated to the package's stated purpose as a pygame utility.
The yaml-report-formatter package on PyPI versions 0.1.0, 0.2.0, and 0.3.0 contains malicious code that exfiltrates sensitive information via a covert DNS channel. Upon import, it starts a background daemon thread that reads a token from a local file and uses it to fetch data from a private endpoint. This data is base64-encoded, split into DNS labels, and exfiltrated through DNS lookups to an attacker-controlled domain. The package's advertised functionality as a YAML formatter does not justify this network activity, indicating clear malicious intent.