THREATPKG
SYNC STALE

Supply-chain threat intelligence

Incident detail

criticalpypi·credential theft·osv

Malicious code in neuralforge-ml (PyPI)

neuralforge-ml

Risk score

92

AI summary

Indexed incident for neuralforge-ml (pypi).

Description


-= Per source details. Do not edit below this line.=-

Source: kam193 (c0a68c3ef2f7680eab753f62cc1792ae7df68bb15400e09971cc9c34a444307b)

The package contains stub code only imitating real actions. Starting with version 0.9.9, the code contains exfiltration capability activated under specific conditions.


Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-neuralforge-ml

Reasons (based on the campaign):

  • exfiltration-env-variables

  • obfuscation

Technical details

Affected versions

<function fixed() { [native code] }

Indicators

  • affected_version<function fixed() { [native code] }75%

Timeline

  1. Advisory published
  2. Indexed by ThreatPkg

Related incidents