{"items":[{"id":"NVI-00008675","kind":"supply_chain_event","title":"Malicious code in seapy-ops (PyPI)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5j6r-jv3q-c93f"],"plain_summary":"GitHub lists this malware advisory for seapy-ops, seapy-ops, seapy-ops, seapy-ops, seapy-ops. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a76869aca0551ce6e638fae253de1b10","url":"https://github.com/advisories/GHSA-5j6r-jv3q-c93f","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5j6r-jv3q-c93f","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:27.401Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.0.0"]},{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.0.1"]},{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.0.2"]},{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.1.0"]},{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.1.1"]},{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.1.2"]},{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.2.1"]},{"certainty":"source_listed","source_ids":["sr-a76869aca0551ce6e638fae253de1b10"],"technology":"seapy-ops","known_exclusions":[],"conditions_summary":"In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden prompt command also uploads the folder before sending the first prompt. File symlinks can expose content outside that directory. Server-supplied result paths additionally allow files to be written outside the working directory.\n\nVersions 1.2.1 and 1.2.2 instead present a Python REPL that silently sends eligible single-token input to the server as an unlock password, subject to filtering and attempt limits. Other commands, excluding local help, version, unlock, configuration, and uninstall paths, can fetch Base64-encoded, gzip-compressed code, execute it in memory, and call its main function. Loader errors are disguised as Python file-not-found errors.\n\nThe malicious assessment is based on concealed file transmission in the earlier releases and interpreter impersonation, concealed input transmission, remote execution, and failure concealment in the later releases. Official distributions were","public_affected_ranges":["= 1.2.2"]}],"null_published_at":"2026-10-31T22:13:27.106Z","source_updated_at":"2026-10-29T15:31:40.000Z","source_disclosed_at":"2026-10-15T06:30:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:27.401Z"}],"next_cursor":null,"snapshot_revision":"42594"}