PkgRadar

PyPI · pypi.org

openviking

Py Install Time Subprocess: subprocess call — process spawning.

Why PkgRadar flagged 0.3.24

SeveritySignalEvidence
mediumPy Install Time Subprocesssubprocess call — process spawning. · openviking-0.3.24/setup.py
highCredential File Packagedopenviking-0.3.24/docs/.npmrc · openviking-0.3.24/docs/.npmrc
mediumRemote Payloadmatched "raw.githubusercontent.com" · openviking-0.3.24/crates/ov_cli/test_ov.sh
mediumRemote Payloadmatched "curl " · openviking-0.3.24/docker/openviking-entrypoint.sh
mediumRemote Payloadmatched "curl " · openviking-0.3.24/openviking_cli/utils/ollama.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.3.24High risk1312026-06-05
0.3.23Review322026-06-03
0.3.22High risk1312026-05-30
0.3.21High risk1312026-05-30

Block this in CI

PkgRadar gates openviking (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi openviking==0.3.24
Start free — 25 scans / moView full evidence