A new malicious package, bundyfed, has been discovered on the PyPI package repository. The package installs a malicious executable that contains an infostealer, a type of malware that steals sensitive information. The malicious code is triggered during installation, overriding the install command in setup.py to execute the infostealer. This poses a significant risk to developers who use bundyfed, as it can compromise their systems and steal sensitive data.

A vulnerability in the parseyaml package on PyPI has been identified, allowing remote code execution through a malicious dependency posing as a YAML loader. The code embeds a stub that executes code from a provided file, indicating malicious intent similar to infostealers. This vulnerability matters to developers and operators as it enables remote code execution, potentially compromising systems and data.

A malicious code campaign has been identified in the extrahtml package on the PyPI repository. The malicious code, embedded in a YAML loader dependency, executes remote code by downloading and running a script from a provided file. This campaign has malicious intent, similar to infostealers, and is categorized as a clear threat. The malicious code is intentionally included in the package, and its purpose is to execute remote code, making it a serious security concern for developers and users of the extrahtml package.

Malicious code was discovered in the RubyGems control-character-command-injection (CCCI) package. The code declares an extension script in its metadata that RubyGems executes during installation. This script collects system information, including hostname, username, and directory paths, and sends it to a third-party server via a TLS connection. The server is not affiliated with the package publisher and receives data without user interaction. This vulnerability allows unauthorized data collection and is considered a security risk for systems using RubyGems. Developers and operators should update their dependencies and review their package installation processes to mitigate this issue.

A malicious RubyGem, agentic-call-control, has been discovered to exfiltrate sensitive system information without user consent during installation. The gem's native extension script collects and sends host identifiers, directory paths, and system file contents to a hardcoded server over a TLS connection. This activity is not related to the gem's intended purpose and serves as a reconnaissance attack. The affected gem may be used to gather sensitive information from systems where it is installed.