PkgRadar

PyPI · pypi.org

claude-coordinator

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 0.4.37

SeveritySignalEvidence
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · claude_coordinator-0.4.37/coord/github_ops.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.4.37High risk352026-06-17
0.4.36High risk352026-06-17
0.4.35High risk352026-06-17
0.4.34High risk352026-06-17
0.4.33High risk352026-06-16
0.4.32High risk352026-06-16
0.4.31High risk352026-06-15
0.4.30High risk352026-06-15
0.4.29High risk352026-06-15
0.4.28High risk352026-06-15
0.4.27High risk352026-06-15
0.4.26High risk352026-06-13
0.4.25High risk352026-06-12
0.4.24High risk302026-06-07
0.4.23High risk302026-06-07
0.4.22High risk302026-06-06
0.4.21High risk302026-06-06
0.4.20High risk302026-06-04
0.4.19High risk302026-06-04
0.4.18High risk302026-06-03
0.4.17High risk302026-06-02
0.4.16High risk302026-06-02
0.4.15High risk302026-05-31
0.4.14High risk302026-05-31
0.4.13High risk302026-05-30
0.4.12High risk302026-05-30
0.4.11High risk302026-05-30
0.4.10High risk302026-05-30
0.4.9High risk302026-05-30
0.4.8High risk302026-05-30
0.4.7High risk302026-05-30
0.4.6High risk302026-05-30

Block this in CI

PkgRadar gates claude-coordinator (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi claude-coordinator==0.4.37
Start free — 25 scans / moView full evidence