odoo-addon-spp-base

{"modified":"2026-07-08T17:03:30Z","published":"2026-06-08T16:16:14Z","schema_version":"1.7.4","id":"MAL-2026-5367","summary":"Malicious code in odoo-addon-spp-base (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c6e43f21a6bdcbb6cfa1837833232c9888fb8012bd2ebae8607a6d08eaee9f06)\nNo suspicious behaviors were observed in this package. There are no install-time or import-time network calls, no credential or filesystem access patterns, no obfuscated payloads, and no lifecycle scripts performing privileged operations. The package appears to be a standard Odoo addon module.\n\n## Source: ossf-package-analysis (da9c7bdf0b4ac969bfa720be2b3f87caa4c82a6d3ac7eeda5e74946aa3c1a1de)\nThe OpenSSF Package Analysis project identified 'odoo-addon-spp-base' @ 99.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"ecosystem":"PyPI","name":"odoo-addon-spp-base"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"odoo_addon_spp_base-99.0.0.tar.gz","hashes":{"blake2b_256":"5f7f5f3f8041ba6b52244675ab8af5c51de0f0df9d1f9c116363fc6db94a674d","md5":"a8534086be88e252a08216d2f896f72a","sha256":"38374f936e0a6af4fdcc0e8a332096844f215cfe930d744ef9eb88f7057455f7"}}]}}}],"references":[{"type":"PACKAGE","url":"https://pypi.org/project/odoo-addon-spp-base/99.0.0/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"da9c7bdf0b4ac969bfa720be2b3f87caa4c82a6d3ac7eeda5e74946aa3c1a1de","import_time":"2026-06-09T12:03:47.64272604Z","modified_time":"2026-06-08T16:16:14Z","versions":["99.0.0"]},{"source":"amazon-inspector","sha256":"c6e43f21a6bdcbb6cfa1837833232c9888fb8012bd2ebae8607a6d08eaee9f06","import_time":"2026-07-08T17:01:28.643462851Z","id":"IN-MAL-2026-008076","modified_time":"2026-07-08T16:21:09Z","versions":["99.0.0"]}]}}