Skip to content
OpenAdvisories
Unscored PYSEC-2022-252

The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which…

Published Aug 26, 2022 · Updated Oct 9, 2025 · Assigned by PYSEC

Description

The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI deep-translator >= 1.8.5 — PYSEC-2022-252

References