PyPI · pypi.org

agenticx

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 0.4.2

Severity	Signal	Evidence
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · agenticx-0.4.2/agenticx/cli/agent_tools.py
high	Py Runtime Dynamic Dangerous Import	Dynamic __import__('os') — reflection bypass for static checks. · agenticx-0.4.2/agenticx/longrun/studio_routes.py
high	Py Runtime Dynamic Dangerous Import	Dynamic __import__('os') — reflection bypass for static checks. · agenticx-0.4.2/agenticx/studio/voice_endpoints.py
medium	Credential file access	matched "aws_access_key" · agenticx-0.4.2/agenticx/integrations/mem0/embeddings/aws_bedrock.py
medium	Credential file access	matched "GOOGLE_APPLICATION_CREDENTIALS" · agenticx-0.4.2/agenticx/integrations/mem0/embeddings/vertexai.py
medium	Credential file access	matched "aws_access_key" · agenticx-0.4.2/agenticx/integrations/mem0/llms/aws_bedrock.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.4.2`	High risk	110	2026-06-06
`0.4.1`	High risk	105	2026-05-30

Block this in CI

PkgRadar gates agenticx (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi agenticx==0.4.2