{"id":"GHSA-gvvw-rr8m-fj76","aliases":[],"status":"published","title":"uniapi version 1.0.7 contained an information harvesting script.","description":"uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and `POST` the information to another remote URL. This code was found in the PyPI release artifacts and was not present in the public GitHub repository.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-01-27T12:30:28Z","modified":"2025-02-19T19:59:26Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"uniapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"last_affected":"1.0.7"}]}],"versions":["1.0.7"]},{"source":"osv","ecosystem":"PyPI","package":"uniapi","versions":["1.0.7"]}],"references":[{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/uniapi/PYSEC-2025-2.yaml","tags":["web"]},{"url":"https://inspector.pypi.io/project/uniapi/1.0.7/packages/0f/40/c6e06c22bbc22ef45f40bf5a7711763fa08fec4d16b4718d86fd60970131/uniapi-1.0.7.tar.gz/uniapi-1.0.7/uniapi/__init__.py#line.11","tags":["web"]},{"url":"https://github.com/kam193/package-campaigns/blob/main/pypi/campaigns/highly_suspicious/2025-01-uniapi.json","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gvvw-rr8m-fj76"}],"sources":{"ghsa":[{"id":"GHSA-gvvw-rr8m-fj76","title":"uniapi version 1.0.7 contained an information harvesting script.","description":"uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and `POST` the information to another remote URL. This code was found in the PyPI release artifacts and was not present in the public GitHub repository.","status":"published","published":"2025-01-27T12:30:28Z","modified":"2025-02-19T19:59:26Z","updated_at":"2026-11-02T14:38:32.275316Z"}],"osv":[{"id":"GHSA-gvvw-rr8m-fj76","title":"uniapi version 1.0.7 contained an information harvesting script.","description":"uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and `POST` the information to another remote URL. This code was found in the PyPI release artifacts and was not present in the public GitHub repository.","status":"published","published":"2025-01-27T12:30:28Z","modified":"2025-02-19T19:59:23Z","updated_at":"2026-11-02T15:46:48.191583Z"}]}}