Threats Tagged 'pypi'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22) setup.py registers a custom install command (PostInstallCommand) that runs my_private_pkg/index.py automatically on `pip install`. That script gathers installer-side identifiers — os.getlogin(), socket.gethostname(), local IP address, os.getcwd(), platform.system() and platform.machine() — and POSTs them as JSON to a hardcoded collector URL at https://webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed. A duplicate of the exfiltration payload is shipped as vercel_runtime_python/index.py, and vercel_runtime_python/__init__.py contains the same PostInstallCommand wiring referencing my_private_pkg/index.py; the module name mimics Vercel's Python runtime. The package name and the internal vercel_runtime_python module name are consistent with a dependency-confusion lure targeting an internal `my-private-pkg` name and Vercel's runtime namespace: the only on-install effect is a reconnaissance beacon to an attacker-controlled webhook.site endpoint identifying the host that mistakenly resolved the public name.

The uncompromising code formatter Security Fix(es): Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.(CVE-2026-32274)

HighVulnerabilityUnited StatesGermanyIndia+7#cve#cve-2026-32274#cwe-22

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6) The package presents itself as a Vercel Python runtime helper but ships no runtime functionality. Its only substantive code path is a public function send_info() that gathers hostname, resolved IP, operating system, and machine architecture via get_device_info() and POSTs the result as JSON to the hardcoded URL https://webhook.site/f9bff304-3053-4d54-be05-86537267514a. The destination is not caller-configurable, is not documented, and is not associated with Vercel. Any consumer that invokes the advertised API silently discloses host reconnaissance data to an attacker-controlled webhook.site inbox. The typosquat-shaped name (mimicking an official Vercel component) combined with a module surface consisting solely of host-info collection and outbound POST is consistent with reconnaissance-oriented installer targeting rather than a legitimate runtime library. ## Source: kam193 (5bd13c006fe4fbaf8bb81d068f6e3c822ea1e664b24d0045370aead862ccd06f) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cb2bf0fd5f445eed9825601f2b4497502054176d106d4fecb9eabf38312dd582) prosocks 1.0.25 enrolls the installer's host as a remote-controlled SOCKS5 exit node under a hardcoded control plane at https://kalnetz.store. setup.py's custom install command writes prosocks.bat into the Windows Startup folder (establishing boot persistence) with the command '"{python_exe}" -m prosocks https://kalnetz.store' and immediately spawns that process during `pip install`. The top-level module additionally calls _auto_launch() so that any `import prosocks` spawns a detached subprocess running the same agent. Once running, ProSocksAgent.register() queries ip-api.com and api.ipify.org for the host's public IP, generates an agent_id and proxy password, and POSTs agent_id, hostname, public IP, proxy port, and password to https://kalnetz.store/api/register, then binds a SOCKS5 server on 0.0.0.0:9050 accessible from any network the host can reach. Heartbeat and bandwidth telemetry are POSTed to /api/heartbeat and /api/bandwidth, and IP changes trigger re-registration. All requests to the panel and IP-lookup services are made with TLS verification disabled (verify=False). The combination of install-time execution, import-time execution, Windows Startup persistence, hardcoded non-first-party control plane, and an unauthenticated SOCKS5 listener on all interfaces whose credentials are handed to that control plane matches a proxyware/botnet backdoor. ## Source: kam193 (a1ca37b881f19975a8ab8b23bd5e69b51355333374385aabfc5784b69bf95545) The package automatically joins the machine to a proxy network. Depending on the version, it can happen during the package installation or when importing the module. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-prosocks Reasons (based on the campaign): - other - peristence-autorun - persistence

A denial of service vulnerability exists in plone.app.contenttypes when uploading files or images with excessively long filenames. This can cause Plone to become unresponsive and make the UI difficult to use for editing or deleting the content. The issue has been patched in specific versions of plone.app.contenttypes and related fixes are available in plone.app.dexterity. No workarounds are known.

A malicious version 2.0.34 of the MemoryOS Python package on PyPI was published containing a Go-based implant named sckit. This implant runs a background binary that collects various credential files from the user's home directory and exfiltrates them to attacker-controlled servers under skyleen.fr. It also includes functionality to propagate itself into other repositories and packages accessible with the stolen credentials. The implant uses encrypted communication with its command-and-control servers and deletes itself after execution. Additionally, the package's build backend can steal CI environment publishing tokens, enabling further compromise of downstream package publishing.

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.

The pullgetsage package on PyPI contains malicious code that exfiltrates Telegram Desktop session data. Upon import, it archives the Telegram Desktop 'tdata' directory, which holds session keys, and sends it to a hardcoded external endpoint. This enables full account takeover of the installer's Telegram account. The malicious behavior is disguised with misleading identifiers and silent error handling. The package falsely claims to be a library filled with books, unrelated to Telegram functionality.

The starlette-healthchecks package on PyPI is identified as a malicious typosquatting attempt. It offers minimal legitimate functionality but primarily performs telemetry calls, indicating malicious intent. A similar package named starlette-healthcheck was recently removed from PyPI. This campaign is categorized as malicious due to its intent to deceive users and potentially collect unauthorized data.

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.