PyPI · pypi.org

gptme

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 0.31.1.dev20260608

Severity	Signal	Evidence
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · gptme-0.31.1.dev20260608/gptme/eval/execenv.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · gptme-0.31.1.dev20260608/gptme/tools/browser.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.31.1.dev20260608`	High risk	25	2026-06-08
`0.31.1.dev20260604`	High risk	25	2026-06-04
`0.31.1.dev20260601`	High risk	25	2026-06-01

Block this in CI

PkgRadar gates gptme (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi gptme==0.31.1.dev20260608