browser-history-analytics@0.1.5
Vulnerability report · Last retrieved from osv.dev October 8, 2026 at 10:42 AM UTC
OSV ID
MAL-2025-191695
Ecosystem
pypi
Summary
When starting the server with expected functionality with potentially sensitive content, the package silently sends the location (external IP) to a remote location. If the computer is directly exposed to the Internet, it allows the uploader to get access to the data. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-06-browser-history-analytics Reasons (based on the campaign): - action-hidden-in-lib-usage - other - obfuscation
Source: kam193 (e1ac674eaa856956dea531487502bd21a51f5324bdfcaf788645bbbb41eb27f5)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.