PkgRadar

PyPI · pypi.org

primust-verify

Py Runtime Base64 Decode: base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern.

Why PkgRadar flagged 1.8.1

SeveritySignalEvidence
highPy Runtime Base64 Decodebase64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · primust_verify-1.8.1/src/primust_verify/verifier.py

Scanned versions

VersionVerdictScoreScanned (UTC)
1.8.1High risk302026-06-11
1.8.0High risk302026-06-04
1.7.0High risk302026-06-04
1.6.0High risk302026-06-04
1.5.0High risk302026-06-04
1.4.2High risk302026-06-03
1.4.1High risk302026-06-01
1.4.0High risk302026-06-01
1.3.2High risk302026-05-31
1.3.1High risk302026-05-30
1.3.0High risk302026-05-30

Block this in CI

PkgRadar gates primust-verify (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi primust-verify==1.8.1
Start free — 25 scans / moView full evidence