PyPI · pypi.org

paperforge

Py Runtime Dynamic Dangerous Import: Dynamic __import__('sys') — reflection bypass for static checks.

Why PkgRadar flagged 1.5.15

Severity	Signal	Evidence
high	Py Runtime Dynamic Dangerous Import	Dynamic __import__('sys') — reflection bypass for static checks. · paperforge-1.5.15/paperforge/skills/paperforge/scripts/pf_deep.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · paperforge-1.5.15/paperforge/worker/update.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`1.5.15`	High risk	60	2026-06-01
`1.5.14`	High risk	60	2026-05-31

Block this in CI

PkgRadar gates paperforge (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi paperforge==1.5.15