—

PYSEC-2022-43021

Details

The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/d8s-asns

Introduced in: 0

No fixed version published yet for d8s-asns (pip). Pin to a known-safe version or switch to an alternative.

References

https://github.com/democritus-project/d8s-asns/issues/9[REPORT]
https://pypi.org/project/d8s-asns/[PACKAGE]
https://pypi.org/project/democritus-csv/[PACKAGE]