GHSA-gvvw-rr8m-fj76
GHSA-gvvw-rr8m-fj76 · uniapi version 1.0.7 contained an information harvesting script.
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and `POST` the information to another remote URL. This code was found in the PyPI release artifacts and was not present in the public GitHub repository.
- Veröffentlicht
- Aktualisiert
Technologie-Stack: python
Betroffene Produkte und Versionen
uniapi PyPI
- Softwareversionen
- 1.0.7
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/kam193/package-campaigns/blob/main/pypi/campaigns/highly_suspicious/2025-01-uniapi.json
- https://github.com/pypa/advisory-database/tree/main/vulns/uniapi/PYSEC-2025-2.yaml
- https://inspector.pypi.io/project/uniapi/1.0.7/packages/0f/40/c6e06c22bbc22ef45f40bf5a7711763fa08fec4d16b4718d86fd60970131/uniapi-1.0.7.tar.gz/uniapi-1.0.7/uniapi/__init__.py#line.11
- https://osv.dev/vulnerability/GHSA-gvvw-rr8m-fj76