PyPI · pypi.org
sgithidownloader
Py Import Time Subprocess: subprocess call — process spawning.
Why PkgRadar flagged 2.1.2
| Severity | Signal | Evidence |
|---|---|---|
| medium | Py Import Time Subprocess | subprocess call — process spawning. · sgithidownloader-2.1.2/venv/lib/site-packages/docutils/writers/odf_odt/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · sgithidownloader-2.1.2/venv/lib/site-packages/jaraco/context/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · sgithidownloader-2.1.2/venv/lib64/site-packages/docutils/writers/odf_odt/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · sgithidownloader-2.1.2/venv/lib64/site-packages/jaraco/context/__init__.py |
| high | Py Runtime Base64 Decode | base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · sgithidownloader-2.1.2/venv/lib/site-packages/PIL/ImageGrab.py |
| high | Py Runtime Base64 Decode | base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · sgithidownloader-2.1.2/venv/lib64/site-packages/PIL/ImageGrab.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · sgithidownloader-2.1.2/venv/lib/site-packages/jaraco/functools/__init__.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · sgithidownloader-2.1.2/venv/lib/site-packages/pip/_vendor/pkg_resources/__init__.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · sgithidownloader-2.1.2/venv/lib/site-packages/pkg_resources/__init__.py |
| medium | Py Import Time Ctypes Load | ctypes.CDLL/cdll.LoadLibrary — loads native code into the process. · sgithidownloader-2.1.2/venv/lib/site-packages/yt_dlp/__init__.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · sgithidownloader-2.1.2/venv/lib64/site-packages/jaraco/functools/__init__.py |
| medium | Py Import Time Eval Exec | Python eval()/exec() called on a string. · sgithidownloader-2.1.2/venv/lib64/site-packages/pip/_vendor/pkg_resources/__init__.py |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
2.1.3 | Low risk | 0 | 2026-06-02 |
2.1.2 | High risk | 326 | 2026-05-31 |
2.1.1 | High risk | 326 | 2026-05-31 |
2.1.0 | High risk | 326 | 2026-05-30 |
Block this in CI
pkgradar gate --ecosystem pypi sgithidownloader==2.1.2