python-engineio versions prior to 4.13.2 have a vulnerability where the maximum payload size is sometimes not enforced, allowing denial of service via excessive memory allocation. This occurs in two configurations: POST requests using ASGI with long polling transport, and WebSocket messages using Aiohttp with WebSocket transport. Version 4.13.2 fixes this by enforcing payload size limits and discarding oversized requests early.
The nono-py library has a vulnerability in its policy JSON handling that can cause sandboxed processes to bypass intended network restrictions. Specifically, the policy-derived ProxyConfig does not enforce the proxy_only capability automatically, allowing direct network access outside the configured proxy allowlist. Additionally, the policy JSON accepts unknown security-sensitive fields, which can be silently ignored if misspelled or unsupported. This may lead to broader network access than intended, potentially exposing sensitive data depending on the environment. Users on older Linux kernels without Landlock ABI v4 must ensure proxy configurations are properly coupled with proxy_only enforcement, as environment variable injection alone is insufficient.
A vulnerability in nono-py versions prior to 0.11.0 allows an authorization bypass due to a policy confusion issue. The Python API's restrictive configuration for reverse-proxy credential routes is unsafe by default, permitting broader network access than intended. Specifically, an empty allowed_hosts setting results in an implicit allow-all policy inside nono-proxy, enabling a sandboxed child process to use the local proxy as a transparent CONNECT tunnel to unintended hosts. This bypasses the intended route-only proxy access policy, potentially exposing internal or internet services to unauthorized access or data exfiltration. The severity is medium by default but can be high in environments relying on strict egress controls. No known exploits are reported, and no patch information is provided.
The PyPI package 'pdf-converter-pro' version 1.0.0 is a malicious package that masquerades as a PDF conversion utility but contains no actual PDF generation code. Instead, it exfiltrates Python source code files from the user's home directory, current directory, and filesystem roots by sending them to an attacker-controlled Telegram chat using a hardcoded bot token. The package tracks already exfiltrated files locally to avoid duplicates and does not provide the advertised functionality. This behavior is triggered when the package's main method is called with specific literal arguments.
Backpropagate versions 1.1.0 and 1.1.1 include a Reflex web UI that exposes training controls without enforcing authentication despite operator-facing flags claiming to do so. This allows any client able to reach the UI port to access sensitive functions such as reading uploaded datasets, triggering training runs, pushing to HuggingFace Hub repositories, and causing denial-of-service via disk fill. The vulnerability arises because the backend never reads the authentication environment variable and lacks middleware to enforce access control. The issue is fixed in version 1.2.0 with proper authentication middleware and multiple defense layers.
A vulnerability in nono-py versions >=0.9.0 <0.10.1 allows sandboxed child processes on Linux kernels without Landlock network support to bypass proxy-only network restrictions. This occurs because the seccomp-notify proxy-only fallback is not supervised, enabling direct TCP connections that should be denied. The issue affects proxy-only enforcement on older Linux kernels prior to 6.7. The highest impact is unauthorized access to cloud metadata endpoints, potentially exposing credentials.
### Impact
The HTML backend did not perform sufficient validation during resource handling:
- Accepted `file://` URIs enabling local file system access when `enable_local_fetch=True`
- Path resolution allowed traversal outside intended directories via `../` sequences and absolute paths
- Did not block internal network resources under `enable_remote_fetch=True`
- HTTP redirects were not validated, potentially redirecting to unintended schemes
- No resource limits for remote image downloads and `data:` URIs
### Patches
Fixed in versions 2.91.0 (initial fixes) and 2.94.0 (additional improvements). The fixes implement:
- Updated local path treatment: absolute files always blocked, relative paths require `enable_local_fetch=True` (default: False) and containment within configured `base_path` for path traversal protection
- `file://` scheme stripped & treated as local path (above)
- IP address validation to prevent SSRF
- HTTP redirect validation, connection and read timeouts
- Size limit for both remote images (with streaming download) and base64-decoded data URIs
### Workarounds
Keep both `enable_local_fetch=False` and `enable_remote_fetch=False` (defaults) when processing untrusted HTML documents.
### References
- Initial fixes: [v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)
- Additional improvements: [v2.94.0](https://github.com/docling-project/docling/releases/tag/v2.94.0)
A Cross-site Scripting (XSS) vulnerability exists in jupyter/nbconvert versions up to 7.17.0. The vulnerability arises because the `text/vnd.mermaid` output is rendered directly into HTML exports without proper escaping, allowing injection of arbitrary HTML or JavaScript. This affects any server using nbconvert to convert notebooks to HTML, potentially enabling attackers to execute scripts in the context of users viewing the exported HTML.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3975a0998bf76dddc25f0138b1d4b408bb06304b3203dc1e62e0110b2b56425f)
InLifeGram distributes a modified copy of the `pyrogram` Telegram client library and installs it into the top-level `pyrogram` import namespace, so `import pyrogram` after installation resolves to this fork. The fork's Client start path has been modified to lazily import a sibling module (`from. import app as secret`) and, when the authenticated account is a bot (`self.me.is_bot`), call `secret.init(self)` wrapped in a bare `except Exception: pass`. The call hands the fully authenticated client object — containing the bot token, api_id/api_hash, and MTProto auth_key — to undocumented code. The receiving `app.py` module consists of a single `exec(zlib.decompress(base64.b85decode(b'...')).decode())` over an ~11KB opaque blob, with no other functionality and an Indonesian-language header threatening anyone who removes 'credits'. The multi-layer obfuscation (base85 → zlib → exec), the silent invocation on bot authentication, and the bare-except suppression are the canonical shape of a session/token-stealing backdoor. README links a sibling project `VLife-Gram` by the same author, indicating a family of trojanized forks. Any program that installs InLifeGram and runs a Pyrogram bot will silently surrender its bot session to the hidden payload on every successful login.
## Source: kam193 (9e2d3483845391abac4b854096ffc1c7767818f9e2b02486d969ee2be0638dc9)
The modified version of a Telegram bot library. The obfuscated code, launched when the user starts their own bot application, attaches malicious backdoor commands to the Telegram bot. They allow hardcoded users to execute any commands in the bot's environment.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-inlifegram
Reasons (based on the campaign):
- clones-real-package
- obfuscation
- The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
- rat
- target:telegram
- action-hidden-in-lib-usage
- backdoor
The sqligen package on PyPI contains malicious code that executes a remote payload during installation on Windows systems. The setup.py file includes obfuscated code that triggers execution of a remote HTA file via mshta.exe, resulting in arbitrary code execution under the installing user's privileges. This malicious behavior is hidden behind misleading variable names and encoding to evade detection. The threat affects multiple specific versions of sqligen and is classified as critical due to the potential for remote code execution.
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
The openblox PyPI package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. The setup.py script runs a function that constructs and executes a command to launch mshta.exe with a remote URL, causing the download and execution of remote malicious code. The package masquerades as a Roblox-related library but actually contains unrelated code and obfuscated commands to evade detection.
The extra-huggingface package on PyPI is a malicious typosquatting package impersonating the Hugging Face ecosystem. It contains a remote access trojan (RAT) implemented via a large native Windows binary that connects to an attacker-controlled server to receive and execute commands. The package installs persistence mechanisms to survive system reboots and exfiltrates sensitive data, including browser information. It masquerades as an educational tool but is designed for malicious purposes such as data theft and unauthorized remote control.
The pyext6cc8cd package version 1.0.0 on PyPI contains malicious code in its setup.py that executes arbitrary commands during installation. Specifically, it decodes a hex string to run the macOS Calculator application via subprocess.Popen unconditionally before the package setup completes. This behavior demonstrates that the package runs untrusted code at install time, posing a risk of arbitrary command execution. The package metadata is placeholder and it contains no functional code, indicating it is a proof-of-concept or test artifact. The obfuscation technique used to hide the command is designed to evade detection by scanners. While the current payload is benign, it could be replaced with destructive or data-exfiltration commands.
Lemur versions prior to 1.9.2 contain a post-authentication Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-55162) in certificate verification. An authenticated user with operator role can upload a crafted certificate containing malicious CRL Distribution Point or OCSP responder URLs. Lemur fetches these URLs without proper validation or destination filtering, allowing requests to internal network services such as instance metadata endpoints or private IP ranges. This can lead to internal network probing, potential information disclosure, and cache poisoning of CRL data.
The PyPI package 'mi-test-99-tuapellido' version 99.9 contains malicious code that executes on import. It runs a shell command that sends the output of the 'id' command (user and group identity information) to an attacker-controlled domain via an unencrypted HTTP POST request. The package metadata indicates it is a placeholder or proof-of-concept, consistent with dependency confusion or namespace squatting attacks. This behavior occurs without user consent or any legitimate functionality. The package is identified as malicious by multiple sources and is designed to exfiltrate basic host information.
Feast versions prior to 0.63.0 contain an unsafe deserialization vulnerability in the registry server. This flaw allows unauthenticated attackers to achieve remote code execution by sending a crafted gRPC request that exploits the user_defined_function.body field, which is deserialized without authorization checks. The vulnerability is fixed in version 0.63.0.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8f881805b709189d00bc52dc57c407bfecdae44fb343f92634a301c31525f6b0)
Despite advertising itself as a breach-monitoring SDK, this package executes a remote-access trojan and credential harvester against any installer that imports it. On `import security_alerts`, `analytics.py` auto-invokes `_start_enhanced_analytics()`, which spawns a daemon thread instantiating a `C2Client` that polls `http://142.93.211.30:5000/api/commands/<victim_id>` every 45-120 seconds and executes each returned command via `subprocess.run(cmd, shell=True,..., cwd=os.path.expanduser('~'))`, posting stdout/stderr/returncode back to `/api/results`. Before activating, `C2Client._ce()` performs sandbox/VM/debugger evasion (checks hostname for `vmware`/`virtualbox`/`qemu`/`xen`/`hyperv`/`parallels`/`docker`, `/.dockerenv`, and `sys.gettrace()`) to avoid analyst environments. Separately, `AnalyticsCollector.start_collection` (triggered on first SecurityAlerts API call) reads `~/.ssh/` private keys, `~/.aws/credentials`+`config`, `~/.gitconfig`, `~/.git-credentials`, `~/.docker/config.json`, `~/.npmrc`, `~/.pypirc`, and walks the filesystem for `.env` files, then POSTs the contents to `http://142.93.211.30:5000/api/telemetry` under a `credentials` key. The benign-looking `monitor.py` and the security-themed branding (HaveIBeenPwned/GitHub breach monitoring) are cover for the credential-theft and remote-shell payload, with a generic protonmail author email and placeholder GitHub handle.
## Source: kam193 (abfac31e96dfe4ed0e31b062d71b7b4bc03e718bba77a7334a79fd73ceb7ecd7)
During import, package starts code that executes remote commands from C2 server. Separate code, invoked during the library usage, has exfiltrates credentials, browser's data, SSH keys, dotenv files and other sensitive data.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-security-alerts-sdk
Reasons (based on the campaign):
- exfiltration-credentials
- exfiltration-env-variables
- exfiltration-browser-data
- The package contains code to detect if it is running in a sandbox environment.
- infostealer
- Downloads and executes a remote malicious script.
- exfiltration-ssh-keys
PickleScan versions before 1.0.4 do not block certain Python standard library modules that allow direct arbitrary command execution. This flaw enables attackers to craft malicious pickle files that import these unblocked modules, bypassing PickleScan's safety validation and leading to remote code execution. The advisory has been withdrawn as a duplicate of GHSA-g38g-8gr9-h9xp but remains for reference.
Chainlit versions prior to 2.10.1 have a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without verifying session ownership. This enables attackers to assume the victim's permissions and roles, potentially invoking tools and accessing data restricted to the authenticated user.