PkgRadar

PyPI · pypi.org

wpsecscan

Webhook Exfil Endpoint: matched "webhook.site"

Why PkgRadar flagged 2.8.5

SeveritySignalEvidence
highWebhook Exfil Endpointmatched "webhook.site" · wpsecscan-2.8.5/wpsecscan/checks/webhook_url_fingerprint.py
highPy Runtime Dynamic Dangerous ImportDynamic __import__('subprocess') — reflection bypass for static checks. · wpsecscan-2.8.5/wpsecscan/__main__.py
highCredential file accessmatched ".azure\\" · wpsecscan-2.8.5/wpsecscan/checks/webhook_url_fingerprint.py
highPy Runtime Dynamic Dangerous ImportDynamic __import__('sys') — reflection bypass for static checks. · wpsecscan-2.8.5/wpsecscan/daemon/_legacy.py

Scanned versions

VersionVerdictScoreScanned (UTC)
2.8.5High risk1402026-06-11
2.8.4High risk1402026-06-10
2.8.3High risk1402026-06-01
2.8.2High risk1402026-05-31
2.8.1High risk1402026-05-31
2.8.0High risk1052026-05-30
2.7.3High risk1052026-05-30
2.7.2High risk1052026-05-30
2.7.1High risk1052026-05-30
2.7.0High risk1052026-05-30
2.6.0High risk1052026-05-30
2.5.0High risk1052026-05-30

Block this in CI

PkgRadar gates wpsecscan (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi wpsecscan==2.8.5
Start free — 25 scans / moView full evidence