The PyPI package 'ml-data-shared' versions 12.0.1 and 16.0.1 contain malicious code that exfiltrates basic system information and all environment variables during installation. This behavior classifies the package as a malicious threat with intent to steal information. No official patch or remediation guidance is provided. The risk is considered limited based on the nature of the exfiltrated data.
The ml-nps-shared package on PyPI contains malicious code that exfiltrates basic system information and all environment variables during installation. This behavior classifies it as an infostealer with limited risk. The affected versions are 6.0.3 and 8.2.3. No official patch or remediation guidance is provided. There are no known exploits in the wild at this time.
The PyPI package 'ml-fdbk-shared' versions 1.0.0 and 2.3.1 contains malicious code that exfiltrates basic system information and all environment variables during installation. This behavior classifies the package as a malicious infostealer with limited risk. No official patch or remediation guidance is currently provided.
The ml-shared package on PyPI versions 6.3.0 and 8.8.0 contains malicious code that exfiltrates basic system information and all environment variables during installation. This behavior classifies the package as a malicious infostealer with limited risk. No official patch or remediation guidance is currently available.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2.
The mcp-search-server package on PyPI was re-registered by a different user after removal by the original author. Versions published in July 2026 contain a stub feature called 'share compute swarm' that silently phones home on every run. This functionality was not fully implemented but is linked to a simultaneous campaign involving another package that covertly deployed coin miners. The mcp-search-server package appears to have been preparing to deploy cryptocurrency mining malware on users' machines. The campaign is classified as malicious with clear intent to harm or exploit users.
The ai-perf-toolkit package version 2.4.2 on PyPI contains malicious code that initiates cryptomining upon import. The cryptomining activity targets a hardcoded wallet and requires pre-installed mining software to operate. This behavior classifies the package as malicious with clear intent to abuse system resources for unauthorized cryptocurrency mining.
The phabricator-client package on PyPI versions 99.0.0 through 99.0.4 contains malicious code that exfiltrates basic host information such as IP address and username. The package overrides the install command in setup.py to execute this malicious code during installation. The package has no legitimate purpose beyond this data exfiltration.
### Summary
A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the client to read files it should not have access to.
### Details
UI adapters reconstruct file parts from client-submitted message history and forward them to the model provider. File **URL** parts are validated against a scheme allowlist before being forwarded, but `UploadedFile` references — which point to a file by provider file ID or cloud-storage URI (e.g. `s3://…`, `gs://…`) — were forwarded without validation.
Because the provider resolves an `UploadedFile` using the server-side identity (IAM role, service account, or provider API key) rather than the client's, a client that crafts message history containing an attacker-chosen `UploadedFile` can cause the server to read objects belonging to its own account or to other tenants, given a referenceable identifier.
### Impact
Applications that pass untrusted client-submitted message history to an agent through a UI adapter (such as the Vercel AI adapter). Exploitation requires the attacker to reference a valid file identifier; depending on how the application names objects, such identifiers are not always unguessable.
### Patches
Upgrade to `1.106.0` (1.x) or `2.0.0b6` (the 2.x beta line), which validate `UploadedFile` references on client-submitted messages the same way file URLs are validated.
### Workarounds
If users cannot upgrade, do not pass untrusted client-submitted message history to the agent, or strip `UploadedFile` parts from incoming messages before running the agent.
pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup() stores bearer tokens only under the default suffix paths and never adds the custom path to the token map, so self._tokens.get(path) returns None and the authentication guard is skipped. An unauthenticated remote attacker can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers. This issue is fixed in version 2.2.1.
The PyPI package 'vtranalytic' versions 9.0.1 and 9.0.4 contains malicious code that implements a remote-administration toolkit controlled via a Telegram bot. It allows execution of arbitrary system commands, creation of OS users, privilege changes, and file upload/download on the host. The package also harvests sensitive data such as Telegram bot tokens, SSH keys, and saved credentials from the host and exfiltrates them to the attacker. The package metadata indicates an anonymous and deceptive publication. This threat enables full remote control of affected hosts by the attacker possessing the bot token.
The random-ua-generator package on PyPI version 0.0.1 contains malicious code that, upon import, initiates a keylogger and exfiltrates data from cryptocurrency wallets. This behavior classifies it as a malicious package with clear intent to steal sensitive information.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (cce3c8791da7093bb0d6aaf8b79f49e5cbbcc4114f075f60121fc99b31c74e09)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.
A denial-of-service vulnerability exists in the yamux stream multiplexer implementation of py-libp2p (<=0.6.0). The vulnerability arises because the code does not validate incoming DATA frame lengths against the receive window before reading the frame body. An attacker can send a single frame claiming a very large body (up to 4 GB), causing the victim's yamux read loop to block indefinitely and stall all streams on that connection. This requires no special setup beyond completing a standard libp2p handshake.
The PyPI package 'trongridy' version 0.0.1 is identified as malicious software designed for private key exfiltration. It is associated with a campaign targeting cryptocurrency users, specifically related to Tron (TRX). The package may impersonate legitimate libraries by cloning their README files. There are no known exploitations in the wild reported so far.
A vulnerability in vantage6 allows an algorithm developer to edit another developer's algorithm that is pending or under review due to missing ownership checks on edit permissions. This flaw enables unauthorized modification of algorithm metadata, such as updating the image or image tag, which could lead to approval of an unintended image version. No patches or workarounds are currently available for this issue. The vulnerability affects vantage6 versions up to and including 5.0.2.
GitPython versions prior to 3.1.55 contain a vulnerability where environment variables in URLs passed to Repo.create_remote() or Remote.add() are expanded and embedded into the repository configuration. This occurs because the fix for a prior vulnerability did not cover these API calls, leaving the default behavior to expand environment variables in URLs. As a result, sensitive environment secrets can be exfiltrated by embedding them in URLs that are stored in .git/config and transmitted to attacker-controlled hosts during fetch or pull operations.
The PyPI package 'discordnv' version 0.8.0 contains malicious code that, upon import, executes a function which hides the console window and stealthily harvests Discord authentication tokens and Roblox cookies from the victim's machine. It exfiltrates these credentials to a hardcoded Discord webhook and a Google Apps Script endpoint. The package also establishes persistence by adding itself to the Windows startup registry key to run on every user login. Its advertised functionality as a Roblox DataStore helper is a facade unrelated to its actual malicious behavior.
GitPython versions up to 3.1.52 contain a configuration injection vulnerability where attacker-controlled submodule names can inject arbitrary config directives into the parent repository's .git/config file. This occurs because section names are insufficiently sanitized, allowing injection of directives like core.sshCommand that can lead to remote code execution on the victim's next git operation. The vulnerability is fixed in versions after 3.1.52.
BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.