MAL-2026-15693Critical▾ Abyssal⚠ Exploited in the wild

Malicious code in py-devoli-common (PyPI)

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score70/ 100 · Elevated

impact 52.3 · likelihood 0 · exploitation 18

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 24, 2026

Updated

Sep 9, 2026

CVSS

—

Vendor

py-devoli-common

Product

py-devoli-common

CWE

—

Depth score

70 · Elevated

EPSS

—

Platforms

—

Source

OSV

Vector

—

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

10 events · 22 days

Aug 24, 2026Published
Disclosed via OSV
Sep 9, 2026Record revised
Last analysed / modified upstream
Sep 14, 2026Severity changed
critical → none
Sep 14, 2026Severity changed
none → critical
Sep 14, 2026Severity changed
critical → none
Sep 14, 2026Severity changed
none → critical
Sep 14, 2026In-the-wild flag cleared
Sep 14, 2026Severity changed
critical → none
Sep 14, 2026Exploitation in the wild observed
Sep 14, 2026Severity changed
none → critical

py-devoli-common #osv #pip #malware

Affected

py-devoli-common

Full technical detail▾

Overview

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (33a1bb1bf9c4c225131c5ad323e7b0c1a9f29f34aea30a496ac77661ea05605d)

The package was found to contain malicious code or consuming dependency that contains malicious code

Affected packages

py-devoli-common

Remediation

Refer to the advisory for the patched release.

References

https://pypi.org/project/py-devoli-common/999.999.999/

Change history

Field changes observed since this record was first indexed.

Sep 14, 2026Exploitation in the wild observed
Sep 14, 2026Severity none → critical
Sep 14, 2026In-the-wild exploitation flag cleared
Sep 14, 2026Severity critical → none
Sep 14, 2026Exploitation in the wild observed
Sep 14, 2026Severity none → critical
Sep 14, 2026In-the-wild exploitation flag cleared
Sep 14, 2026Severity critical → none
Sep 14, 2026Exploitation in the wild observed
Sep 14, 2026Severity none → critical
Sep 14, 2026In-the-wild exploitation flag cleared
Sep 14, 2026Severity critical → none

#osv#pip#malware

Change history

Field changes observed since this record was first indexed.

Sep 14, 2026Exploitation in the wild observed

Sep 14, 2026Severity none → critical

Sep 14, 2026In-the-wild exploitation flag cleared

Sep 14, 2026Severity critical → none

Sep 14, 2026Exploitation in the wild observed

Sep 14, 2026Severity none → critical

Sep 14, 2026In-the-wild exploitation flag cleared

Sep 14, 2026Severity critical → none

Sep 14, 2026Exploitation in the wild observed

Sep 14, 2026Severity none → critical

Sep 14, 2026In-the-wild exploitation flag cleared

Sep 14, 2026Severity critical → none