The PyPI package 'protecteda' version 0.1.0 contains embedded malicious code that acts as an infostealer when executed as a module. This malware is part of a campaign identified as 2026-11-protecteda with clear malicious intent to steal information.
The zyto package on PyPI versions 0.2.0 through 0.2.3 contains malicious code that executes during installation by overriding the install command in setup.py. This behavior is intended to prepare for embedding a Remote Access Trojan (RAT), indicating clear malicious intent. The package has been flagged by some antivirus vendors as malicious and is part of a broader campaign identified as 2026-11-filipt.
Stanza versions 1.14.0 up to but not including 1.15.0 contain a remote code execution vulnerability via unsafe pickle deserialization in the lemmatizer component. The lemmatizer checkpoint stores a compressed pickle of a pos_dict, which is deserialized without restriction, allowing attacker-supplied model files to execute arbitrary code during pipeline construction. This occurs when loading a lemma model checkpoint from an untrusted source. The vulnerability is fixed in version 1.15.0 by using a restricted unpickler that only allows safe data types.
The hijuko-pilara package on PyPI is identified as malicious software that uses fake HTTP-downloaded dependencies to track downloads. It serves no legitimate purpose beyond this tracking activity and is associated with dependency confusion tactics. The package is considered low-harm and likely related to pentesting or research activities.
The filipt package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This behavior has been identified as malware, specifically a remote access trojan (RAT), by multiple security vendors. The affected versions are 0.1.0 through 0.1.5. There is no CVSS score available for this threat.
The pyprig package on PyPI is a malicious clone of the legitimate Pydantic package. It includes code that downloads and executes a remote script from a GitHub repository during the initialization of any models, injecting a runner module. The remote code observed during analysis was a placeholder, but the package's intent is clearly malicious.
The privacypass-py package on PyPI masquerades as a Privacy Pass client library but contains no cryptographic functionality. Instead, it performs data exfiltration by collecting sensitive environment variables, system information, and process details, then sending this data to a hardcoded external IP address over unencrypted HTTP. This malicious behavior occurs both during package installation and on module import, bypassing typical build isolation protections.
The pystr-codec package on PyPI contains malicious code that executes on every Python startup. It runs obfuscated JavaScript via a Bun engine to exfiltrate credentials to a public GitHub repository, establish persistence, accept remote commands, spread using stolen credentials, and perform destructive actions if credentials become invalid. This malware is linked to the Miasma-family worm.
The doctreelstm package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The multi-convert package on PyPI contains malicious code in specific versions of its dependency 'is-it-ai'. Version 0.1.4 of the dependency includes a trigger that fingerprints the environment and contacts a remote server to download and execute a remote executable. Other versions serve as cover to hide the malicious activity. This campaign is identified as having clear malicious intent, including downloading and executing remote code.
The md-to-slides package on PyPI contains malicious code hidden in a specific dependency (is-it-ai) in version 0.1.1. This malicious code fingerprints the environment and contacts a remote server to download and execute a remote executable if instructed. Other versions appear to be decoys to conceal the malicious version. This campaign is clearly malicious and targets users by embedding harmful actions within a library dependency.
The skills-analyzer package on PyPI contains malicious code in its dependency is-it-ai version 0.1.1. This malicious code fingerprints the environment and contacts a remote server, which may respond with a URL to download and execute further malicious payloads. Other versions of the package exist to obscure the presence of the malicious version. The campaign is identified as a targeted attack with clear malicious intent, including downloading and executing remote executables.
The is-it-ai package on PyPI contains malicious code in specific versions (0.1.0, 0.1.1, 0.1.3) that, when triggered, fingerprints the environment and contacts a remote server. If the server responds with a URL, the package downloads and executes a remote executable. This behavior is part of a targeted attack campaign involving intentional inclusion of malicious code in a dependency, designed to hide malicious actions behind legitimate package versions.
pypdf versions prior to 6.21.4 contain a vulnerability where opening an incomplete PDF file without a trailer can cause an infinite loop during the search for the standard xref table. This flaw allows an attacker to craft a malicious PDF that triggers this behavior. The issue has been fixed in pypdf version 6.21.4.
A high-severity vulnerability in pypdf prior to version 6.21.4 allows an attacker to craft a malicious PDF that causes large memory usage when parsing the page tree with many shared resources. This issue has been fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in pypdf prior to version 6.21.4 allows an attacker to craft a malicious PDF that triggers an infinite loop when cloning a DictionaryObject. This flaw has been assigned CVE-2026-119205 and is rated high severity with a CVSS score of 7.1. The issue is fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
Authlib's implementation examples for the RFC 7592 dynamic client registration management protocol omit a critical security check that binds the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and a target client_id to bypass authorization controls and read, update, or delete other clients' registrations. The vulnerability affects Authlib versions from 0.15 up to but not including 1.9.1 and is fixed in version 1.9.1.
A vulnerability in pypdf versions prior to 6.21.3 can cause long runtimes when retrieving page labels from a crafted PDF file. This issue has been fixed in version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in pypdf prior to version 6.21.3 allows an attacker to craft a malicious PDF that triggers large memory usage when loading an invalid dictionary in strict mode. This can lead to denial of service due to resource exhaustion. The issue has been fixed in pypdf version 6.21.3.
CVE-2026-119208 is a vulnerability in pypdf versions prior to 6.21.3 where an attacker can craft an encrypted PDF file with a manipulated /Count value. Accessing the page count of such a PDF can cause excessive runtimes and large memory usage. This issue has been fixed in pypdf version 6.21.3.