Suspicious 85% python Download

skillspector 2.3.7

Hostile findings indicate data exfiltration

“SkillSpector: Security scanner for AI agent skills (Claude Code, Cursor, and similar). Scans skills for vulnerabilities, malicious patterns…”

Anomalous package hides outbound data exfiltrationAnomalous package runs an obfuscated install hook
SHA-256f0b26f81d34fe1dc83febb5ce61801779f70df658e0560501818b6b942144072
URLhttps://files.pythonhosted.org/packages/86/a0/551d264b767d9c46e18706edd43ba3d0374fc87ce96fd49d56f824cc2179/skillspector-2.3.8-py3-none-any.whl
MaleculeK₂(LiTe)O₉(S₅As₄C₄Ca₂Dy₃Er₃ILa₂Pr)H₅(F₇Cm₁₀Db₆Os₃Po₅)Md₂(PaPt)

Also flagged by osv (MAL-2026-6561: Malicious code in skillspector (PyPI)).

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.