PkgRadar

PyPI · pypi.org

agilab

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 2026.6.16

SeveritySignalEvidence
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · agilab-2026.6.16/src/agilab/evidence/evidence_contract.py
mediumSuspicious Publish Context{"package_age_days":2,"publisher":"Jean-Pierre Morard","burst_same_day":2,"burst_week":15,"lure":null,"version_anomaly":true,"new_account":false}

Scanned versions

VersionVerdictScoreScanned (UTC)
2026.6.16High risk502026-06-16
2026.6.14.1High risk502026-06-14
2026.6.13.1High risk502026-06-13
2026.6.13High risk502026-06-13
2026.6.12High risk502026-06-12
2026.6.8High risk402026-06-08
2026.6.5High risk402026-06-06
2026.6.4.2High risk402026-06-04
2026.6.4.1High risk402026-06-04
2026.6.4Low risk02026-06-04
2026.6.2.post1Low risk02026-06-03
2026.6.2High risk402026-06-02
2026.6.1High risk402026-06-01
2026.5.31.post1High risk402026-05-31
2026.5.31High risk402026-05-30
2026.5.30.post1High risk402026-05-30
2026.5.30High risk402026-05-29
2026.5.29High risk452026-05-28

Block this in CI

PkgRadar gates agilab (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi agilab==2026.6.16
Start free — 25 scans / moView full evidence