{"id":"PYSEC-2025-4","summary":"When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.","details":"Published in 2019, the automslc package is a Python library\nthat bypasses Deezer API restrictions to download music.\nThe package was found to exfiltrate user data to a hardcoded server,\nwhich could be used for malicious purposes.\n","modified":"2025-02-26T19:26:49Z","published":"2025-02-26T19:26:49Z","references":[{"type":"EVIDENCE","url":"https://inspector.pypi.io/project/automslc/5.1/packages/c4/4b/94312dc0c889394507467e3194bb52988377784aa6b0e3747648eb9aeae3/automslc-5.1.tar.gz/automslc-5.1/dzee_helper.py#line.13"},{"type":"WEB","url":"https://socket.dev/blog/malicious-pypi-package-exploits-deezer-api-for-coordinated-music-piracy"}],"affected":[{"package":{"name":"automslc","ecosystem":"PyPI","purl":"pkg:pypi/automslc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/automslc/PYSEC-2025-4.yaml"}}],"schema_version":"1.7.5","credits":[{"name":"Mike Fiedler","type":"COORDINATOR"},{"name":"Socket.dev","type":"REPORTER"}]}