Skip to content

Update manifest files with the latest threats#30

Open
obarrera wants to merge 2 commits intomainfrom
update-threat-manifests-1745344093
Open

Update manifest files with the latest threats#30
obarrera wants to merge 2 commits intomainfrom
update-threat-manifests-1745344093

Conversation

@obarrera
Copy link
Collaborator

This PR updates the manifest files with the latest threats.

@socket-security
Copy link

socket-security bot commented Apr 22, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedroot-vortex@​2.0.12010097100100
Addedroot-vortex@​2.1.12110098100100
Addedroot-vortex@​2.1.32110098100100
Addeddiscordpydebug@​0.0.2221009910080
Addedimuthes-crypt@​0.0.0a41001009910070
Addednicelogger@​2.010010099100100
Addedthe-retry@​0.1.110010099100100
Addedsnemail@​1.1.1610010099100100
Addednumfi@​0.5.0100100100100100

View full report

@socket-security
Copy link

socket-security bot commented Apr 22, 2025

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert (click for details)
Block Critical
discordpydebug@0.0.2 is Known malware.

Note: The code is a high-risk malicious backdoor that enables remote attackers to execute arbitrary commands and read files on the host system, exfiltrating data to a suspicious external server. It should be considered malware and flagged for immediate removal.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/discordpydebug@0.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
discordpydebug@0.0.2 is Known malware.

Note: The code is a high-risk malicious backdoor that enables remote attackers to execute arbitrary commands and read files on the host system, exfiltrating data to a suspicious external server. It should be considered malware and flagged for immediate removal.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/discordpydebug@0.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.0.1 is Known malware.

Note: The flagged file executes Python code that directly invokes os.system to run “sudo su”, thereby attempting to spawn a root shell without any authentication or user consent, and thereafter echoes “Root Access Granted!”. This constitutes a backdoor‑style privilege escalation mechanism capable of granting unauthorized root privileges and enabling arbitrary command execution on the host system.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.0.1 is Known malware.

Note: The code attempts to gain unauthorized root access using 'sudo su', which is a significant security risk. This action is potentially malicious, as it does not request user consent or provide a legitimate reason for needing root access.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.1.1 is Known malware.

Note: The flagged file executes Python code that directly invokes os.system to run “sudo su”, thereby attempting to spawn a root shell without any authentication or user consent, and thereafter echoes “Root Access Granted!”. This constitutes a backdoor‑style privilege escalation mechanism capable of granting unauthorized root privileges and enabling arbitrary command execution on the host system.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.1.1 is Known malware.

Note: The flagged file executes Python code that directly invokes os.system to run “sudo su”, thereby attempting to spawn a root shell without any authentication or user consent, and thereafter echoes “Root Access Granted!”. This constitutes a backdoor‑style privilege escalation mechanism capable of granting unauthorized root privileges and enabling arbitrary command execution on the host system.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.1.1 is Known malware.

Note: The code attempts to gain unauthorized root access using 'sudo su', which is a significant security risk. This action is potentially malicious, as it does not request user consent or provide a legitimate reason for needing root access.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.1.3 is Known malware.

Note: The flagged file executes Python code that directly invokes os.system to run “sudo su”, thereby attempting to spawn a root shell without any authentication or user consent, and thereafter echoes “Root Access Granted!”. This constitutes a backdoor‑style privilege escalation mechanism capable of granting unauthorized root privileges and enabling arbitrary command execution on the host system.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.1.3 is Known malware.

Note: The flagged file executes Python code that directly invokes os.system to run “sudo su”, thereby attempting to spawn a root shell without any authentication or user consent, and thereafter echoes “Root Access Granted!”. This constitutes a backdoor‑style privilege escalation mechanism capable of granting unauthorized root privileges and enabling arbitrary command execution on the host system.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
root-vortex@2.1.3 is Known malware.

Note: The code attempts to gain unauthorized root access using 'sudo su', which is a significant security risk. This action is potentially malicious, as it does not request user consent or provide a legitimate reason for needing root access.

Source: requirements.txt

ℹ Read more on: This package | This alert | What is known malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is strongly recommended that malware is removed from your codebase.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/root-vortex@2.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
imuthes-crypt@0.0.0a4 has a License Policy Violation.

License: AGPL-3.0 (imuthes_crypt-0.0.0a4/imuthes/imuthes-crypt/init.py)

Source: requirements.txt

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/imuthes-crypt@0.0.0a4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
imuthes-crypt@0.0.0a4 has a License Policy Violation.

License: AGPL-3.0 (imuthes/imuthes-crypt/init.py)

Source: requirements.txt

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/imuthes-crypt@0.0.0a4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
numpy@2.2.5 has a License Policy Violation.

License: GPL-3.0 (numpy-2.2.5/tools/wheels/LICENSE_osx.txt)

License: FSFAP (numpy-2.2.5/vendored-meson/meson/test cases/frameworks/6 gettext/data3/metainfo.its)

License: GPL-3.0 (numpy-2.2.5/tools/wheels/LICENSE_linux.txt)

License: GPL-3.0 (numpy-2.2.5/tools/wheels/LICENSE_win32.txt)

Source: requirements.txt

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.2.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
numpy@2.2.5 has a License Policy Violation.

License: GPL-3.0-with-GCC-exception (numpy-2.2.5.dist-info/METADATA)

License: GPL-3.0 (numpy-2.2.5.dist-info/LICENSE.txt)

Source: requirements.txt

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.2.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
numpy@2.2.5 has a License Policy Violation.

License: GPL-3.0-with-GCC-exception (numpy-2.2.5.dist-info/METADATA)

License: GPL-3.0 (numpy-2.2.5.dist-info/LICENSE.txt)

Source: requirements.txt

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.2.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
numpy@2.2.5 has a License Policy Violation.

License: GPL-3.0-with-GCC-exception (numpy-2.2.5.dist-info/METADATA)

License: GPL-3.0 (numpy-2.2.5.dist-info/LICENSE.txt)

Source: requirements.txt

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.2.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 51 more rows in the dashboard

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants