hellospa@90.0.0
Vulnerability report · Last retrieved from osv.dev October 8, 2026 at 8:42 AM UTC
OSV ID
MAL-2025-191972
Ecosystem
pypi
Summary
Package exfiltrates credentials, env variables and other sensitive data on running. Notably, exfiltrated cloud credentials were immediately checked from a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-hellospa Reasons (based on the campaign): - exfiltration-generic - exfiltration-env-variables - exfiltration-cloud-tokens - exfiltration-credentials
Source: kam193 (276fd70d8b56465c07e6a06281b93ef014fcab93ce00be738e645501713dbdda)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.