MAL-2025-5847

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/vtk-osmesa/MAL-2025-5847.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-5847
Published
2025-07-14T19:49:43Z
Modified
2025-07-14T21:36:23Z
Summary
Malicious code in vtk-osmesa (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (c7551fe96e5c82f2d015f2192ef59cb289a105d8549b9d18285d3fd33e7f1bf4)

The OpenSSF Package Analysis project identified 'vtk-osmesa' @ 900.548.735 (pypi) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "900.548.735"
            ],
            "modified_time": "2025-07-14T19:49:43Z",
            "source": "ossf-package-analysis",
            "sha256": "c7551fe96e5c82f2d015f2192ef59cb289a105d8549b9d18285d3fd33e7f1bf4",
            "import_time": "2025-07-14T20:06:56.917476661Z"
        },
        {
            "versions": [
                "900.548.736"
            ],
            "modified_time": "2025-07-14T20:01:28Z",
            "source": "ossf-package-analysis",
            "sha256": "fbfa8dae1a6eed56bd9367ae529bbf25fac65af65e367d222b02b701c149210e",
            "import_time": "2025-07-14T20:06:56.987789643Z"
        },
        {
            "versions": [
                "900.548.746"
            ],
            "modified_time": "2025-07-14T20:54:03Z",
            "source": "ossf-package-analysis",
            "sha256": "61c30b8c639fc2130b0d95047bc880aa792747c9ea7bf54dcd2a36e1d3019739",
            "import_time": "2025-07-14T21:06:04.010992795Z"
        },
        {
            "versions": [
                "900.548.744"
            ],
            "modified_time": "2025-07-14T20:47:21Z",
            "source": "ossf-package-analysis",
            "sha256": "8309b0e4c8f1581d8b20bb4f161e856c87d46e367861eb44153b074406b1d2fe",
            "import_time": "2025-07-14T21:06:03.931802578Z"
        },
        {
            "versions": [
                "900.548.751"
            ],
            "modified_time": "2025-07-14T21:19:47Z",
            "source": "ossf-package-analysis",
            "sha256": "4751cac9deec1e341e0e7e761dfd8ea8c89830a61df5fd58841e242de8c0eb33",
            "import_time": "2025-07-14T21:36:00.817326305Z"
        },
        {
            "versions": [
                "900.548.747"
            ],
            "modified_time": "2025-07-14T21:12:14Z",
            "source": "ossf-package-analysis",
            "sha256": "ae51c0b2d806da87b9849d348545680dd2510318e9158cfeec9e03f2735e09f6",
            "import_time": "2025-07-14T21:36:00.646529624Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / vtk-osmesa

Package

Name
vtk-osmesa
View open source insights on deps.dev
Purl
pkg:pypi/vtk-osmesa

Affected ranges

Affected versions

900.*

900.548.735
900.548.736
900.548.744
900.548.746
900.548.747
900.548.751