browser-history-analysis @1.0.1
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 4:33 PM UTC
OSV ID
MAL-2025-6469
Ecosystem
pypi
Summary
When starting the server with expected functionality with potentially sensitive content, the package silently sends the location (external IP) to a remote location. If the computer is directly exposed to the Internet, it allows the uploader to get access to the data. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-06-browser-history-analytics Reasons (based on the campaign): - action-hidden-in-lib-usage - other - obfuscation
Source: kam193 (032a326beadf36ce66d29555a7dacc90d6dfc733435dc61852cbc1e5128ee73d)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.