The cosmos-cuda package on PyPI, specifically versions 9999.0.0 and 9999.0.1, contains malicious code that executes during installation and import. It collects the installer's hostname, username, and working directory, then exfiltrates this information to a hardcoded external server. The package uses a high version number to override legitimate internal packages, forcing execution of malicious setup.py code. This behavior leads to arbitrary code execution and data exfiltration on affected systems.
The proxy-check-ii PyPI package version 0.1.0 contains malicious code that installs a prebuilt Go binary acting as a relayed SSH-like server. This backdoor allows remote command execution via a reverse-tunneled remote shell overlay without disclosing this behavior in the package metadata. The package misrepresents itself as a pure-Python wheel and does not provide transparency or configuration options for the embedded SSH daemon. The malicious functionality uses a hardcoded authorized key and a relay network to avoid direct exposure of ports on the victim machine.
Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (c7933cd1ec11531feba788870555eeac615535d8e230b4d252880def9c68ff5e)
tennacity is a one-character typosquat of the popular 'tenacity' library; its README/PKG-INFO are copied verbatim from real tenacity while setup.py lists placeholder author metadata ('Your Name', your.email@example.com) and a 'prints Hello World on import' description. On import, tennacity/__init__.py branches on OS and CPU architecture to download platform-specific binaries from https://easyswapnow.pro/downloads/lix_amd.bin, lix_arm.bin, mac_amd.bin, mac_arm.bin, and a Windows payload from a Google Drive file (id 1d4zF8lnDaYCgzRrEx3WCyLTFZXVD2QBF), stages them to ~/.local/share/config, /Users/Shared/.local/config, and %TEMP%/t.jse, sets the executable bit, and invokes them via subprocess.run. It then installs login-time persistence: a systemd --user unit at ~/.config/systemd/user/python-script.service (enabled via 'systemctl --user enable --now') on Linux and a LaunchAgent at ~/Library/LaunchAgents/com.user.script.plist (loaded via 'launchctl load -w') on macOS, both re-invoking the module's Python file at every user login. The fetched binaries are unpinned, unverified, and hosted on a non-publisher domain unrelated to the package's stated Hello-World purpose.
## Source: kam193 (d1f457b8b07c4cda5c20b76c195faa127906578c1977fb00469c44a7a114f810)
The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on wegoexchange[.]site for further commands.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-tennacity
Reasons (based on the campaign):
- malware
- Downloads and executes a remote executable.
- The package contains code to detect if it is running in a sandbox environment.
- typosquatting
- persistence
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Keras versions prior to 3.12.3 and some earlier versions have a vulnerability in tar archive extraction that allows symlink-based path traversal. This flaw occurs because symlink entries bypass path validation, enabling attackers to create symlinks outside the intended extraction directory. This can lead to unauthorized file reads, overwrites, or directory escapes. The vulnerability is relevant especially in Python 3.10 and 3.11 environments. A patch is available to address this issue. The severity is assessed as medium.
The pokee-data-utils PyPI package version 1.0.1 contains malicious code that harvests credentials and environment data during both installation and import. It reads sensitive internal host files and environment variables, outputs collected data to files and stdout, exposing partial provider credentials and internal host source. The package contains no legitimate utility code and is identified as a supply chain proof-of-concept with full impact. This behavior can lead to sensitive information disclosure in multi-tenant sandbox environments where workspace files are accessible.
The Apple App Store Server Python Library's SignedDataVerifier component improperly validates OCSP responses by accepting stale 'GOOD' responses indefinitely. This flaw allows replay of expired OCSP responses, bypassing certificate revocation checks. Applications using this library with online checks enabled may continue to trust revoked certificates if a stale OCSP response is replayed. The vulnerability affects versions from 0.2.0 up to but not including 3.1.2. No patch information is currently provided.
A denial of service vulnerability exists in the json_repair library before version 0.60.1 due to unbounded CPU consumption caused by circular JSON Schema $ref references. The function resolve_schema() follows $ref pointers in an unbounded loop without cycle detection, allowing an attacker to supply a self-referencing schema that causes an infinite loop. This vulnerability is exploitable without authentication via the demo Flask API. The issue results in a high-severity denial of service by exhausting CPU resources indefinitely.
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.
The PyPI package 'browser-use-headless' version 0.1.4 is a malicious typosquat clone of a legitimate browser automation helper. It contains hidden code that steals sensitive credentials and environment variables from the host system, including AWS, SSH, GCP, Azure, Kubernetes, Docker, Git, npm, and other secret files. The stolen data is base64-encoded and exfiltrated via HTTP POST to a hardcoded external endpoint unrelated to the package's advertised functionality. This credential-stealing behavior is deliberately obscured within the code to evade detection.
The DIRAC PilotManager service contains a SQL injection vulnerability due to unsafe parameter handling in database queries combined with insufficient access control. Functions in the PilotManager pass parameters directly to the database without proper escaping, enabling crafted inputs to manipulate or retrieve unauthorized data. Additionally, the PilotManager access control is set only to "authenticated," allowing any authenticated user to invoke these sensitive functions. This vulnerability allows unauthorized users to read or delete pilot job data. The issue is fixed in DIRAC versions 8.0.79, 9.0.22, and 9.1.10 by implementing proper parameter substitution and stricter access controls.
GeoNode versions 3.2.1 up to but not including 4.2.3 contain a stored cross-site scripting (XSS) vulnerability in the rich text editor. This vulnerability allows an attacker to retrieve a victim's CSRF token and perform actions such as changing the victim's email address, potentially leading to full account takeover. The vulnerability bypasses CORS policy restrictions due to the script element's behavior. The issue is classified as CWE-79 and has a moderate severity rating.
PraisonAI Agents have a vulnerability in their tool approval system where approval is cached only by tool name, not by invocation arguments. This allows subsequent shell command executions to bypass user consent prompts after a single approval. The system also passes all environment variables, including sensitive API keys, to subprocesses without filtering. This combination enables an LLM agent to exfiltrate secrets silently after one approved command. The approval cache persists for the entire agent execution without clearing or expiration. A fix is available in version 4.5.128 that enforces per-invocation approval for critical tools.
The turbocalcng package on PyPI versions 0.1.0 and 0.2.0 contains malicious code that executes attacker-supplied native code in-memory upon import. The package uses XOR obfuscation to hide imports and dynamically loads and runs shellcode in a RWX memory region within a daemon thread. It also communicates with an external domain, indicating potential malicious intent. This behavior is not related to any legitimate arithmetic functionality and represents a hostile code injection threat.
The fast-dotenv package version 1.0.0 on PyPI contains malicious code that activates after a 72–96 hour delay. Once activated, it retrieves a remote command-and-control (C2) configuration from obfuscated URLs and exfiltrates system information, including environment variables with sensitive keywords and SSH key files. The malicious code hides its network destinations using base64 encoding and cover comments, indicating a staged supply-chain credential stealer. The embedded C2 URLs did not exist at the time of analysis but are linked to related malicious repositories. No official patch or remediation is currently available.
The pipspeed package version 0.1.0 on PyPI contains malicious code that fetches a remote JSON configuration from an anonymous mutable paste host. This JSON controls which PyPI package is installed and which function is executed dynamically in the user's Python process, enabling arbitrary remote code execution. The package does not verify or restrict the remote content, allowing an attacker controlling the JSON to execute any code on the victim's machine. This behavior was first discovered by Amazon Inspector and is classified as a malicious package with clear intent to execute harmful actions.
The jupiter-sdk package on PyPI versions 0.1.0 and 0.1.1 contains malicious code that executes remote scripts upon import. Instead of providing legitimate functionality, it downloads and runs a payload from an IPFS gateway without verifying the content beyond the IPFS CID. This payload collects sensitive files such as cryptocurrency wallet keys, SSH keys, and dotenv files, exfiltrates them to IPFS, and connects to a command-and-control server for further instructions. The package masquerades as a Jupiter DEX Aggregator SDK but returns only dummy data, with its primary function being remote code execution and data theft.