PyPI · pypi.org

argus-ai-scanner

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 1.12.0

Severity	Signal	Evidence
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · argus_ai_scanner-1.12.0/dast/sandbox/firecracker/entrypoint.py
high	DNS / OAST exfiltration	matched "oast.fun" · argus_ai_scanner-1.12.0/mcp_scanner/oob_listener.py
medium	Remote Payload	matched "curl " · argus_ai_scanner-1.12.0/dast/sandbox/firecracker/build_and_push_multi.sh

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`1.12.0`	High risk	92	2026-06-01
`1.11.1`	High risk	62	2026-05-31
`1.11.0`	High risk	62	2026-05-31

Block this in CI

PkgRadar gates argus-ai-scanner (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi argus-ai-scanner==1.12.0