PRIMARY-SOURCE REVIEW · 2026-11-03T16:20:00+09:00

PyPI: 2 malicious-package advisories; check affected releases

The publication window contains 2 PyPI malware advisories. This counts advisories, not machines or compromises. The table preserves package names and affected ranges from the original API; an unlisted first fix is not replaced with an assumed safe release.

What to check

Check installation and execution history, lockfiles and distributed images. Isolate affected environments and revoke and reissue keys from a separate clean environment. Removal alone does not establish that persistence is gone; rebuild and investigate logs.

A first fixed version is listed only when the advisory provides one. Advisory counts are not incident counts.

Affected and fixed versions by advisory (2)

GHSA-25jm-3g7h-jgf6

Malicious code in pyprig (PyPI)

  • pyprig (pip): affected = 1.2.0 → fixed No fixed version listed
  • pyprig (pip): affected = 1.2.1 → fixed No fixed version listed
  • pyprig (pip): affected = 1.2.2 → fixed No fixed version listed

GHSA-8wmf-9cp5-g5hq

Malicious code in wallet-tracking (PyPI)

  • wallet-tracking (pip): affected > 0 → fixed No fixed version listed
  • wallet-tracking (pip): affected = 1.0.0 → fixed No fixed version listed
  • wallet-tracking (pip): affected = 1.0.1 → fixed No fixed version listed
  • wallet-tracking (pip): affected = 1.0.3 → fixed No fixed version listed
  • wallet-tracking (pip): affected = 1.0.4 → fixed No fixed version listed
  • wallet-tracking (pip): affected = 1.0.5 → fixed No fixed version listed
  • wallet-tracking (pip): affected = 1.0.6 → fixed No fixed version listed

Primary sources

GHSA-25jm-3g7h-jgf6 / GHSA-8wmf-9cp5-g5hq

Related topics

DBHub: MySQL/MariaDB read-only bypass fixed in 0.22.6 · SD-JWT: silently discarded disclosures can change authorization · npm: 92 malicious-package advisories; check affected releases · RubyGems: 3 malicious-package advisories; check affected releases