Static pattern: py-requests-post

domain-admin@1.6.78

a domain ssl cert admin

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

@ngocsangairvds/vsaf@4.2.9

logging step

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

azure-genome@0.1.4

A Python package for Azure Genome.

sealights-python-agent@2.10.10

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

quasarr@4.5.3

Quasarr connects JDownloader with Radarr, Sonarr and Magazarr. It also decrypts links protected by CAPTCHAs.

cscc-glass-house@1.0.1

Cloud Security Championship CI test utilities

→ No suspicious destination, no remote-exec shape — no network destinations.

vulndify-mcp-server@0.3.0

A minimal MCP server demo exposing a hello tool.

→ No suspicious destination, no remote-exec shape — extraction empty.

txdpy@2026.5

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

qontract-reconcile@0.10.2.dev658

Collection of tools to reconcile services with their desired state as defined in the app-interface DB.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

noteparse@1.1.27

a package for parse html to noteinfo

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

mathepy@7.9.0

Module for Quick Calculations

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).

edison-tools@0.1.17

→ No suspicious destination, no remote-exec shape — 1 other host(s).

aurafarmer@0.3.0

PRO — Terminal AI Coding Agent by SPRUKY

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).