PkgRadar

PyPI · pypi.org

calkit-python

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 0.41.18

SeveritySignalEvidence
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · calkit_python-0.41.18/calkit/core.py
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · calkit_python-0.41.18/calkit/cli/notebooks.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.41.18High risk252026-06-17
0.41.17High risk252026-06-15
0.41.16High risk252026-06-14
0.41.15High risk252026-06-13
0.41.14High risk252026-06-12
0.41.13High risk252026-06-10
0.41.12High risk252026-06-09
0.41.11High risk252026-06-08
0.41.10High risk252026-06-07
0.41.9High risk252026-06-03
0.41.8High risk252026-06-03
0.41.7High risk252026-06-02
0.41.6High risk252026-05-30
0.41.5High risk252026-05-30
0.41.4High risk252026-05-30
0.41.3High risk252026-05-30

Block this in CI

PkgRadar gates calkit-python (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi calkit-python==0.41.18
Start free — 25 scans / moView full evidence