PkgRadar

PyPI · pypi.org

djust

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 1.0.3

SeveritySignalEvidence
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · djust-1.0.3/python/djust/deploy_cli.py

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.3High risk302026-06-08
1.0.3rc2High risk302026-06-08
1.0.3rc1High risk302026-06-07
1.0.2High risk302026-06-07
1.0.2rc3High risk302026-06-06
1.0.2rc1High risk302026-06-06
1.0.1High risk302026-06-05
1.0.1rc1High risk302026-06-05
1.0.0High risk302026-06-02
1.0.0rc18High risk402026-06-01
1.0.0rc17High risk302026-06-01
1.0.0rc16High risk302026-05-30
1.0.0rc15High risk302026-05-30
1.0.0rc14High risk302026-05-30
1.0.0rc13High risk302026-05-30
1.0.0rc12High risk302026-05-30

Block this in CI

PkgRadar gates djust (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi djust==1.0.3
Start free — 25 scans / moView full evidence