MAL-2026-4760
Malicious code in nvidia-nat-semantic-kernel (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (fd31ef3bb7acb152519e55b43037368e8dfc21d444050bec7739778c4ce73381) The wheel's METADATA declares a hard dependency `Requires-Dist: ruamel-yaml-clibz==0.3.5`. The legitimate upstream is `ruamel.yaml.clib` (with dots) maintained as part of the ruamel.yaml project; `ruamel-yaml-clibz` (note trailing 'z', hyphenated form) is not a recognized ruamel artifact and has the shape of a typosquat. Installing this package causes pip to resolve and install `ruamel-yaml-clibz` from PyPI, executing whatever build/install code that package ships. The flagged package's own source is otherwise a benign NVIDIA NeMo Agent Toolkit semantic-kernel integration with no network, exec, or credential-handling behavior — the installer-side risk is entirely in the transitive pull.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for nvidia-nat-semantic-kernel (pip). Pin to a known-safe version or switch to an alternative.