{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "nvidia_nat_semantic_kernel-1.8.0a20260521.dist-info/METADATA",
              "sha256": "40cdbeb77ef82d1a17fef0745c9d3949943788c6af73ab2d186aafba34232d4b",
              "tlsh": "ad4165a52a850afa3bc108c77b8d591ad19aca0ce74e18e5f5e5c1c542ac77283fc0bd"
            }
          ],
          "package_integrity": [
            {
              "filename": "nvidia_nat_semantic_kernel-1.8.0a20260521-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "5d2e1abdc5dbba5c91506af481af0149c0d80161c31e73508a9d27c57dd56bcd",
                "md5": "83c6ac5c5c9ce3ea59d7aaca4651bdf1",
                "sha256": "ccae67168c818fbc122454565bd1498f8b4dcfca534b6dc9b9a86af8b8110f39"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "nvidia-nat-semantic-kernel"
      },
      "versions": [
        "1.8.0a20260521"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-003799",
        "import_time": "2026-05-26T05:51:20.196367971Z",
        "modified_time": "2026-05-21T10:47:05Z",
        "sha256": "fd31ef3bb7acb152519e55b43037368e8dfc21d444050bec7739778c4ce73381",
        "source": "amazon-inspector",
        "versions": [
          "1.8.0a20260521"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fd31ef3bb7acb152519e55b43037368e8dfc21d444050bec7739778c4ce73381)\nThe wheel\u0027s METADATA declares a hard dependency `Requires-Dist: ruamel-yaml-clibz==0.3.5`. The legitimate upstream is `ruamel.yaml.clib` (with dots) maintained as part of the ruamel.yaml project; `ruamel-yaml-clibz` (note trailing \u0027z\u0027, hyphenated form) is not a recognized ruamel artifact and has the shape of a typosquat. Installing this package causes pip to resolve and install `ruamel-yaml-clibz` from PyPI, executing whatever build/install code that package ships. The flagged package\u0027s own source is otherwise a benign NVIDIA NeMo Agent Toolkit semantic-kernel integration with no network, exec, or credential-handling behavior \u2014 the installer-side risk is entirely in the transitive pull.\n",
  "id": "MAL-2026-4760",
  "modified": "2026-05-21T10:47:05Z",
  "published": "2026-05-21T10:47:05Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/nvidia-nat-semantic-kernel/1.8.0a20260521/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in nvidia-nat-semantic-kernel (PyPI)"
}