Logo
pypi

avatar-handler@1.0.0

Vulnerability report · Last retrieved from osv.dev October 9, 2026 at 3:49 PM UTC

Malicious

OSV ID

MAL-2025-191685

Ecosystem

pypi

Summary

Code pretending to handling downloading an image, but in fact is prepared to download and execute a Powershell script image properties. No known usage --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-avatar-handler Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script.

Source: kam193 (c3750cf8fac7fc22334d1fb416e7f3af691425c669829dcc9857abdc1384bbb7)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.

SEE HACKTRON REVIEW →SCAN DEPENDENCIES