PkgRadar

PyPI · pypi.org

pycorpdiff

Py Runtime Pickle Loads: pickle/marshal.loads — deserializes arbitrary objects, RCE if attacker-controlled.

Why PkgRadar flagged 0.1.0a13

SeveritySignalEvidence
mediumPy Runtime Pickle Loadspickle/marshal.loads — deserializes arbitrary objects, RCE if attacker-controlled. · pycorpdiff-0.1.0a13/src/pycorpdiff/datasets/histwords.py

Scanned versions

VersionVerdictScoreScanned (UTC)
0.1.0a27Low risk02026-05-31
0.1.0a26Low risk02026-05-31
0.1.0a25Low risk02026-05-30
0.1.0a18Low risk02026-05-27
0.1.0a17Low risk02026-05-27
0.1.0a16Low risk02026-05-27
0.1.0a15Low risk02026-05-27
0.1.0a14Low risk02026-05-27
0.1.0a13Review152026-05-26

Block this in CI

PkgRadar gates pycorpdiff (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi pycorpdiff==0.1.0a13
Start free — 25 scans / moView full evidence