{"id":"PYSEC-2025-2","aliases":[],"status":"published","title":"uniapi version 1.0.7 contained an information harvesting script.","description":"uniapi version 1.0.7 introduces code that would execute\non import of the module and download a script from a remote URL,\nand would then execute the downloaded script in a thread.\nThe downloaded script would harvest system information\nand `POST` the information to another remote URL.\nThis code was found in the PyPI release artifacts and was not present\nin the public GitHub repository.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-01-24T19:56:53Z","modified":"2025-01-24T19:56:53Z","affected":[{"source":"osv","ecosystem":"PyPI","package":"uniapi","versions":["1.0.7"]}],"references":[{"url":"https://inspector.pypi.io/project/uniapi/1.0.7/packages/0f/40/c6e06c22bbc22ef45f40bf5a7711763fa08fec4d16b4718d86fd60970131/uniapi-1.0.7.tar.gz/uniapi-1.0.7/uniapi/__init__.py#line.11","tags":["evidence"]},{"url":"https://github.com/kam193/package-campaigns/blob/main/pypi/campaigns/highly_suspicious/2025-01-uniapi.json","tags":["web"]}],"sources":{"osv":[{"id":"PYSEC-2025-2","title":"uniapi version 1.0.7 contained an information harvesting script.","description":"uniapi version 1.0.7 introduces code that would execute\non import of the module and download a script from a remote URL,\nand would then execute the downloaded script in a thread.\nThe downloaded script would harvest system information\nand `POST` the information to another remote URL.\nThis code was found in the PyPI release artifacts and was not present\nin the public GitHub repository.\n","status":"published","published":"2025-01-24T19:56:53Z","modified":"2025-01-24T19:56:53Z","updated_at":"2026-11-02T15:52:54.242332Z"}]}}