MAL-2026-4760

Dashboard / Malicious Package / MAL-2026-4760

MAL-2026-4760

Summary: Malicious code in nvidia-nat-semantic-kernel (PyPI)

Details: Source: amazon-inspector (fe66a4b0f7f00b8e8a9abd877b3ab0531d56906cc11f6fa6ecaddd4b0bebbbe1) The package's METADATA declares `Requires-Dist: ruamel-yaml-clibz==0.3.5`, a typosquat of the well-known `ruamel-yaml-clib` (note the trailing 'z'). Installing nvidia-nat-semantic-kernel via pip will silently resolve and install ruamel-yaml-clibz from PyPI, bringing whatever code that lookalike package ships into the installer's environment. The substitution is inconsistent with the rest of the dependency list, which uses standard upstream names, and ruamel-yaml-clib (without the z) is the canonical C-extension companion to ruamel.yaml that the YAML stack normally requires. This is the dependency-confusion / pull-through-typosquat pattern: the host package is the vector, and the harm arrives through the named transitive.

References: https://pypi.org/project/nvidia-nat-semantic-kernel/1.8.0a20260521/, https://pypi.org/project/nvidia-nat-semantic-kernel/1.8.0a20260607/, https://pypi.org/project/nvidia-nat-semantic-kernel/1.9.0a20260611/