Top issues
Detected presence of severe vulnerabilities with active exploitation.
Causes risk: actively exploited vulnerabilities
vulnerabilities
Problem
Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.Prevalence in PyPI community
38 packages
found in
Top 100
303 packages
found in
Top 1k
2611 packages
found in
Top 10k
103184 packages
in community
Next steps
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Detected presence of malware-exploited vulnerabilities.
Causes risk: malware exploited vulnerabilities
vulnerabilities
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Available threat intelligence telemetry has confirmed that the reported vulnerabilities are actively being exploited by malicious actors. Malware code that propagates through these vulnerabilities has been created. This increases the chance of automated malware attacks affecting the software component users.Prevalence in PyPI community
10 packages
found in
Top 100
78 packages
found in
Top 1k
751 packages
found in
Top 10k
27887 packages
in community
Next steps
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Detected presence of critical severity vulnerabilities.
Causes risk: critical severity vulnerabilities
vulnerabilities
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.Prevalence in PyPI community
25 packages
found in
Top 100
212 packages
found in
Top 1k
1951 packages
found in
Top 10k
77976 packages
in community
Next steps
Perform impact analysis for the reported CVEs.
We strongly advise updating the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Detected presence of high severity vulnerabilities.
Causes risk: high severity vulnerabilities
vulnerabilities
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.Prevalence in PyPI community
50 packages
found in
Top 100
352 packages
found in
Top 1k
2858 packages
found in
Top 10k
108771 packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Detected presence of statically linked dependencies distributed with weak copyleft licenses.
Causes risk: weak copyleft linked components
licenses
Problem
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Weak copyleft licenses in particular impose requirements that the user must be able to replace or update the code they apply to. In practical terms, that means the object and library files that statically link to weak copyleft code must be made available publicly. For commercial applications, this is typically undesirable. Therefore, statically linking to weak copyleft code is commonly avoided or even prohibited by the organization policy. Instead of linking statically to weak copyleft licensed code, it is recommended to isolate such code into modules that the publisher-developed, first-party code can dynamically link to without the aforementioned obligations.Prevalence in PyPI community
1 packages
found in
Top 100
13 packages
found in
Top 1k
76 packages
found in
Top 10k
1063 packages
in community
Next steps
Confirm that the software package statically links to a weak copyleft dependency.
Investigate if the software publisher provides this dependency under a non-copyleft license.
Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.
Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.
Top behaviors
Downloads a file.
network
Prevalence in PyPI community
Behavior often found in this community (Common)
17 packages
found in
Top 100
89 packages
found in
Top 1k
547 packages
found in
Top 10k
15951 packages
in community
Reads data from files containing SSL certificates installed on the system.
steal
Prevalence in PyPI community
Behavior often found in this community (Common)
2 packages
found in
Top 100
17 packages
found in
Top 1k
102 packages
found in
Top 10k
1482 packages
in community
Queries the passwd database entry for a given user name.
steal
Prevalence in PyPI community
Behavior often found in this community (Common)
10 packages
found in
Top 100
50 packages
found in
Top 1k
265 packages
found in
Top 10k
5875 packages
in community
Queries the passwd database entry for a given user ID.
steal
Prevalence in PyPI community
Behavior often found in this community (Common)
11 packages
found in
Top 100
73 packages
found in
Top 1k
368 packages
found in
Top 10k
8619 packages
in community
Contains common certificate strings.
settings
Prevalence in PyPI community
Behavior uncommon for this community (Uncommon)
1 packages
found in
Top 100
19 packages
found in
Top 1k
129 packages
found in
Top 10k
2361 packages
in community
Top vulnerabilities
Vulnerability Exploitation Lifecycle
(25 Active Vulnerabilities)
3 (2 Fixable)
CVE-2025-9906h
CVE-2024-55459m
CVE-2023-38546l
22 (22 Fixable)
CVE-2023-38545c
CVE-2024-3660c
CVE-2025-1550c
1 (1 Fixable)
CVE-2023-38545c
None
Exploits Unknown
Exploits Exist
Exploited by Malware
Patching Mandated