PyPI · pypi.org

skypilot-nightly

Py Install Time Subprocess: subprocess call — process spawning.

Why PkgRadar flagged 1.0.0.dev20260612

Severity	Signal	Evidence
medium	Py Install Time Subprocess	subprocess call — process spawning. · skypilot_nightly-1.0.0.dev20260612/setup.py
medium	Py Install Time Subprocess	subprocess call — process spawning. · skypilot_nightly-1.0.0.dev20260612/sky/setup_files/setup.py
medium	Py Import Time Subprocess	subprocess call with shell=True — passes argv to /bin/sh. · skypilot_nightly-1.0.0.dev20260612/sky/skylet/ray_patches/__init__.py
medium	Py Import Time Subprocess	subprocess call — process spawning. · skypilot_nightly-1.0.0.dev20260612/sky/__init__.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · skypilot_nightly-1.0.0.dev20260612/sky/batch/utils.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · skypilot_nightly-1.0.0.dev20260612/sky/client/sdk.py
high	Py Runtime Base64 Decode	base64/hex decode combined with exec/subprocess — classic obfuscated payload pattern. · skypilot_nightly-1.0.0.dev20260612/sky/server/server.py
medium	Remote Payload	matched "raw.githubusercontent.com" · skypilot_nightly-1.0.0.dev20260612/sky/utils/kubernetes/create_cluster.sh
medium	Credential file access	matched ".aws/" · skypilot_nightly-1.0.0.dev20260612/sky/clouds/nebius.py
medium	Credential file access	matched "AWS_ACCESS_KEY" · skypilot_nightly-1.0.0.dev20260612/sky/skylet/events.py

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`1.0.0.dev20260612`	High risk	146	2026-06-12
`1.0.0.dev20260611`	High risk	146	2026-06-11
`1.0.0.dev20260610`	High risk	146	2026-06-10
`1.0.0.dev20260609`	High risk	146	2026-06-09
`1.0.0.dev20260607`	High risk	146	2026-06-07
`1.0.0.dev20260605`	High risk	146	2026-06-05
`1.0.0.dev20260604`	High risk	146	2026-06-04
`1.0.0.dev20260603`	High risk	146	2026-06-03
`1.0.0.dev20260602`	High risk	146	2026-06-02
`1.0.0.dev20260530`	High risk	146	2026-05-30
`1.0.0.dev20260529`	High risk	146	2026-05-30
`1.0.0.dev20260528`	High risk	146	2026-05-30
`1.0.0.dev20260527`	High risk	146	2026-05-30

Block this in CI

PkgRadar gates skypilot-nightly (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi skypilot-nightly==1.0.0.dev20260612