Logo
pypi

sitecard@0.1.14

Vulnerability report · Last retrieved from osv.dev October 23, 2026 at 7:35 PM UTC

Malicious

OSV ID

MAL-2026-18242

Ecosystem

pypi

Summary

The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded location, exposing any user to be accessed by attacker. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-sitecard Reasons (based on the campaign): - backdoor

Source: kam193 (49be8995374d0e3d2bcb8f163675221e14bfb6d7d968a6fa5d8165e4f493997d)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.

SEE HACKTRON REVIEW →SCAN DEPENDENCIES