GitHub Advisoryadvisory · PyPI

GHSA-xm4r-5rj9-2pg3 gratient 0.5 contains credential harvesting code

HIGH Published 2024-08-30 Modified 2024-08-30 Official page ↗
Ecosystem
PyPI
Packages
gratient
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Reviewed
2024-08-30

Affected packages

• PyPI gratient: 0.5 (no fix yet)

Description

gratient is a user-facing library for generating color gradients of text. Version 0.5 contained obfuscated, malicious code targeting Windows platforms, harvesting information and credentials from the user's system and sending them to a remote server. Services may include Mullvad VPN and Telegram.

References