BBOT's `unarchive` module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted during a scan (for example via `filedownload`), bypassed the guard and caused an attacker-controlled symlink to be written into the extraction directory. The effect is limited to planting the symlink (its target is not written through), and only hosts using such a legacy p7zip build are affected; current mainline 7-Zip is not.
The PyPI package 'tronhapy' version 0.0.1 is identified as malicious software designed for private key exfiltration, likely targeting cryptocurrency users. It is part of a campaign named '2025-04-tronix' and is associated with crypto-related exfiltration activities. The package may impersonate legitimate libraries by cloning their README files. There are no known exploits in the wild reported for this package.
The jsonschemavalid package version 4.26.0 on PyPI is a malicious clone of a legitimate package containing embedded reverse shell code. This reverse shell allows an attacker to execute arbitrary commands on the victim's machine. The published malicious version connects to a private IP address, indicating it may not have been fully weaponized at the time of discovery. There is no known exploit in the wild, and no official patch or remediation guidance is provided.
The PyPI package 'tronhap' version 0.0.1 is identified as malicious software designed for private key exfiltration. It is associated with a campaign targeting cryptocurrency-related users, specifically referencing Tron (TRX). The package may impersonate legitimate libraries by cloning their readme files and has been repeatedly uploaded to PyPI. There are no known exploits in the wild at this time.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (8cd6d16792d681b160ae1e11b3f698d8fd3004cd6019704008ad1c649fbe6f67)
Package downloads and runs a remote executable, which was found to downloads further exes and starting coine mining
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-pyqt6darktheme
Reasons (based on the campaign):
- cryptominer
- Downloads and executes a remote executable.
- malware
- The package overrides the install command in setup.py to execute malicious code during installation.
The PyPI package 'waymo-waymax' version 99.0.0 is identified as malicious software designed to perform dependency confusion proof-of-concept attacks. It exfiltrates sensitive data, including full environment variables, by overriding the install command in its setup.py script to execute malicious code during installation. This package is also associated with typosquatting tactics to deceive users into installing it.
Flask-Security-Too versions 5.8.0 and 5.8.1 contain a vulnerability in the WebAuthn reauthentication process that allows an authenticated attacker to bypass session freshness checks. The flaw occurs because the system marks a session as reauthentication-fresh after processing a WebAuthn assertion from any credential, without verifying that the credential belongs to the current session user. This enables an attacker who owns any WebAuthn credential registered on the deployment to satisfy the freshness gate of another user's session, potentially allowing sensitive actions that require recent reauthentication.
In ha-mcp add-on mode for Home Assistant, certain settings and policy routes are accessible without authentication at the bare root path on port 9583 in versions prior to 7.10.0. This allows any client able to reach this port to read or modify add-on configurations, toggle feature flags, manage backups, restart the add-on, and alter approval policies if enabled, without requiring authentication. The vulnerability does not expose Home Assistant data, credentials, or allow code execution. The issue is fixed by restricting root path access to Home Assistant ingress only, with the fix included in versions 7.10.0 and later.
The aiosmtplib library versions prior to 5.1.1 are vulnerable to SMTP command injection due to improper handling of CR/LF characters in sender and recipient email addresses. This allows an attacker to inject arbitrary SMTP commands by including CR/LF sequences in the address fields passed to SMTP methods such as mail(), rcpt(), vrfy(), and expn(). The vulnerability can cause the SMTP client to hang or allow injection of multiple commands in a single address string. The vulnerability is fixed in version 5.1.1.
Socket's AI scanner identified 17 malicious packages across npm and PyPI ecosystems published simultaneously on July 7, 2026. The packages typosquatted legitimate PaySafe, Skrill, and Neteller payment SDK names to steal developer credentials and tokens. The malware implements sophisticated anti-analysis techniques including sandbox detection based on CPU cores and hostname patterns, multi-layer C2 domain obfuscation using XOR encoding, and selective activation gating. Upon execution, the packages exfiltrate environment variables containing API keys, secrets, tokens, and authentication credentials to AWS-hosted infrastructure via an ngrok endpoint. The campaign demonstrates coordinated cross-ecosystem capabilities, proper operational security through varied obfuscation keys, and knowledge of defender technologies, suggesting an organized threat actor with financial motivation.
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.
Open WebUI versions up to 0.7.2 contain a blind Server Side Request Forgery (SSRF) vulnerability in the image editing functionality. The vulnerable function performs an asynchronous GET request on a user-supplied URL without restricting the domain, allowing interaction with local network addresses. Because the SSRF is blind, attackers cannot see the response but can infer open ports on the local network by detecting request failures. This enables port scanning of the local network and potentially interacting with services that accept state-changing GET requests.
Open WebUI versions prior to 0.6.44 are vulnerable to a stored cross-site scripting (XSS) issue via user-controlled iFrame embeds in response messages. The vulnerability arises because the application allows manual modification of chat history to set the embeds property, which is rendered inside an iFrames with a sandbox that improperly enables allow-scripts and allow-same-origin, effectively disabling sandbox protections. This flaw enables attackers to create weaponized chats that execute arbitrary JavaScript in the context of other users' sessions, potentially leading to session token theft and further exploitation. The vulnerability also affects shared chat links, allowing distribution of malicious payloads to other users. No official patch or fix is currently documented in the advisory.
Open WebUI versions prior to 0.7.0 are vulnerable to a stored cross-site scripting (XSS) attack via the iFrame in the citations model. This occurs because users can manually modify chat history to set the 'html' property in document metadata, causing the frontend to render untrusted HTML content inside an iFrame with insufficient sandboxing. The vulnerability allows execution of arbitrary JavaScript when the citation is previewed or viewed in a shared chat. Exploitation requires the victim to expand the sources and click the malicious document. This can lead to session token theft for low-privilege users and potential remote code execution (RCE) risks for admins when combined with another vulnerability. No official patch or fix is currently documented.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (eae82aa94c358f1f00f8a12e8b583cee82efdcf09d2f80263e6851ac0fec98f3)
The PyPI project `jsonschemavalidation` builds a wheel whose installed top-level package is literally `jsonschema` (`[tool.hatch.build.targets.wheel] packages = ["src/jsonschema"]`). Project metadata (author name, homepage pointing at github.com/python-jsonschema/jsonschema, README, description) mirrors the legitimate upstream `jsonschema` project. Installing this distribution places files into the real `jsonschema` import namespace on the installer, so `import jsonschema` in downstream code would resolve to the code shipped by this distribution rather than the genuine one. The current 4.26.0 contents appear to be an unmodified copy of upstream and no exfiltration, install-time fetch-and-execute, credential harvesting, silent-relay, backdoor, or other installer-harm payload is present in this version. The concern is the namespace-collision channel itself: a name-confusion distribution that populates a widely-used import name is a plausible squat/hijack setup, but name-similarity and namespace collision alone are subjective signals without a payload, so human review is appropriate rather than an automatic block.
## Source: kam193 (b7a6e1ff837eac0382559815111106e3e85b3825b72f38355551d5874cc24b0e)
A clone of a legitimate package with an embeded reverse shell. In the published version, the reverse shell was connecting to a private IP address suggesting the package was not yet fully weaponized.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-jsonschemavalidation
Reasons (based on the campaign):
- The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.
- clones-real-package
- obfuscation
The paysafe-sdk package version 1.0.0 on PyPI contains malicious code that exfiltrates basic data and parts of sensitive environment variables to a remote host. The malicious code is obfuscated, includes sandbox detection mechanisms, and hides its actions within library usage. This is a dependency confusion attack with clear intent to steal information.
The paysafe-payments package version 1.0.0 on PyPI contains malicious code that exfiltrates basic data and sensitive environment variables to a remote host. The malicious code includes obfuscation techniques and sandbox detection to evade analysis. This package is part of a known malicious campaign involving dependency confusion and hidden malicious actions within library usage.
The paysafe-kyc package version 1.0.0 on PyPI contains malicious code that exfiltrates basic data and parts of sensitive environment variables to a remote host. The malicious code includes sandbox detection and obfuscation techniques to evade analysis. This package is part of a campaign involving dependency confusion and hidden malicious actions within library usage.
The paysafe-api package version 1.0.0 on PyPI contains malicious code that exfiltrates basic data and parts of sensitive environment variables to a remote host. It employs obfuscation techniques and detects sandbox environments to evade analysis. This package is involved in a dependency confusion campaign and hides malicious actions within its library usage.
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.