lore-cs
Advanced tools
Affected versions:
SECURITY RESEARCH CANARY - dependency confusion PoC for the Epic Games HackerOne program. Intentionally inert: reports install once and does nothing else.
lore-csThis distribution is intentionally inert and is published solely as a dependency-confusion proof of concept under the Epic Games HackerOne bug bounty program.
site-packages, and the process cwd.POST to http://185.158.107.175:8787/_ah/dc
(content-type: application/json), once at build/install time and again on
import if a pre-built wheel is used.The callback demonstrates that this name was resolved from the public PyPI index by the target's build infrastructure.
FAQs
SECURITY RESEARCH CANARY - dependency confusion PoC for the Epic Games HackerOne program. Intentionally inert: reports install once and does nothing else.
We found that lore-cs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.
Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.
Threat Research
/Security News
Cursor removed a malicious Claude Code 2.1.313 extension from its marketplace. Socket examines registry records and the initial claims about its distribution.