PkgRadar

PyPI · pypi.org

otpme

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 0.3.0a222

SeveritySignalEvidence
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · otpme-0.3.0a222/otpme/lib/fuse.py
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · otpme-0.3.0a222/otpme/lib/stuff.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.3.0a222High risk552026-06-12
0.3.0a221High risk552026-06-11
0.3.0a219High risk552026-06-10
0.3.0a218High risk552026-06-09
0.3.0a217High risk552026-06-09
0.3.0a216High risk552026-06-08
0.3.0a215High risk552026-06-08
0.3.0a214High risk552026-06-06
0.3.0a213High risk552026-06-05
0.3.0a212High risk552026-06-05
0.3.0a211High risk552026-06-01
0.3.0a210High risk552026-05-30
0.3.0a209High risk552026-05-30
0.3.0a208High risk552026-05-30
0.3.0a207High risk552026-05-30

Block this in CI

PkgRadar gates otpme (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi otpme==0.3.0a222
Start free — 25 scans / moView full evidence