GHSA-g86j-hwg9-77q5
SentinelOne impersonated via PyPI packages
In December 2022, threat actors impersonated SentinelOne by uploading fake software development kits (SDKs) onto PyPI. The SDKs contain fully functional SentinelOne clients, but the packages also contained malicious backdoors that are only executed when called on programmatically, as opposed to during installation. The packages have since been taken down from PyPI.
What each source reports
GitHub AdvisoriesNo score
SentinelOne impersonated via PyPI packages
In December 2022, threat actors impersonated SentinelOne by uploading fake software development kits (SDKs) onto PyPI. The SDKs contain fully functional SentinelOne clients, but the packages also contained malicious backdoors that are only executed when called on programmatically, as opposed to during installation. The packages have since been taken down from PyPI.
- Record
GHSA-g86j-hwg9-77q5- Updated
- 2026-11-02
OSVNo score
SentinelOne impersonated via PyPI packages
In December 2022, threat actors impersonated SentinelOne by uploading fake software development kits (SDKs) onto PyPI. The SDKs contain fully functional SentinelOne clients, but the packages also contained malicious backdoors that are only executed when called on programmatically, as opposed to during installation. The packages have since been taken down from PyPI.
- Record
GHSA-g86j-hwg9-77q5- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sentinelonePyPI | 1.0.0 to 1.2.1 | None known |
sentinelone-sdkPyPI | 6.2.1 to 6.2.2 | None known |
sentinelonesdkPyPI | 1.0.0 to 1.0.0 | None known |
sentinelonePyPI | 1.0.0 to 1.0.0 | None known |
sentinelonesdkPyPI | Listed versions 1.0.0 | None known |
sentinelonePyPI | Listed versions 1.0.0 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-g86j-hwg9-77q5 is a vulnerability with no CVSS score yet in sentinelone, published December 27, 2022. No source lists public exploit code. No source names a fixed version.