PyPI · pypi.org

ctao-aiv-toolkit

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 5.1.3

Severity	Signal	Evidence
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · ctao_aiv_toolkit-5.1.3/src/aivkit/gitlab.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`5.1.3`	High risk	30	2026-06-01

Block this in CI

PkgRadar gates ctao-aiv-toolkit (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi ctao-aiv-toolkit==5.1.3