GHSA-gvvw-rr8m-fj76
GHSA-gvvw-rr8m-fj76 · uniapi version 1.0.7 contained an information harvesting script.
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and `POST` the information to another remote URL. This code was found in the PyPI release artifacts and was not present in the public GitHub repository.
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
uniapi PyPI
- Versions du logiciel
- 1.0.7
Aucun correctif publié
Sources originales
- https://github.com/kam193/package-campaigns/blob/main/pypi/campaigns/highly_suspicious/2025-01-uniapi.json
- https://github.com/pypa/advisory-database/tree/main/vulns/uniapi/PYSEC-2025-2.yaml
- https://inspector.pypi.io/project/uniapi/1.0.7/packages/0f/40/c6e06c22bbc22ef45f40bf5a7711763fa08fec4d16b4718d86fd60970131/uniapi-1.0.7.tar.gz/uniapi-1.0.7/uniapi/__init__.py#line.11
- https://osv.dev/vulnerability/GHSA-gvvw-rr8m-fj76