https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:31:59 +0000 https://vulnerability.circl.lu/vuln/pysec-2026-3987 <p><strong>Affected:</strong> PyPI: MemoryOS</p> <p>An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project&#39;s own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/_stage0.py, which launches a bundled sckit binary that collects credentials (.pypirc, .npmrc, .git-credentials, SSH keys, token-like environment variables) and sends them to *.skyleen[.]fr.</p> <p>Remove 2.0.34 and rotate any credentials reachable from affected machines.</p> <p>- wheel SHA256: 39ee644406829a4b630b31759c20478bc22d576d6a59b253ed86f72c360aa5ef - sdist SHA256: 92b46d18fc553c494eda714f204459edb74c205bf53b18a9092bcf02c7a6c5be</p> <p><strong>Affected:</strong> PyPI: MemoryOS</p> <p>An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project&#39;s own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/_stage0.py, which launches a bundled sckit binary that collects credentials (.pypirc, .npmrc, .git-credentials, SSH keys, token-like environment variables) and sends them to *.skyleen[.]fr.</p> <p>Remove 2.0.34 and rotate any credentials reachable from affected machines.</p> <p>- wheel SHA256: 39ee644406829a4b630b31759c20478bc22d576d6a59b253ed86f72c360aa5ef - sdist SHA256: 92b46d18fc553c494eda714f204459edb74c205bf53b18a9092bcf02c7a6c5be</p> https://vulnerability.circl.lu/vuln/pysec-2026-3987