PyPI · pypi.org

maestro-fleet

Py Install Time Subprocess: subprocess call — process spawning.

Why PkgRadar flagged 4.7.2

Severity	Signal	Evidence
medium	Py Install Time Subprocess	subprocess call — process spawning. · maestro_fleet-4.7.2/maestro/setup.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · maestro_fleet-4.7.2/maestro/identity/auth.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`4.7.2`	High risk	90	2026-06-13
`4.7.1`	High risk	90	2026-06-11
`4.7.0`	High risk	90	2026-06-11
`4.6.2`	High risk	90	2026-06-08
`4.6.1`	High risk	90	2026-06-08
`4.6.0`	High risk	90	2026-06-07
`4.5.5`	High risk	90	2026-06-05
`4.5.4`	High risk	90	2026-06-05
`4.5.3`	High risk	90	2026-06-05
`4.5.2`	High risk	90	2026-06-04
`4.5.1`	High risk	90	2026-06-03
`4.5.0`	High risk	90	2026-05-30

Block this in CI

PkgRadar gates maestro-fleet (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi maestro-fleet==4.7.2