tsshare

Details

**Severity:** Critical

**Affected versions:** `= 1.0.19`

The package 'tsshaere' was identified as containing malicious obfuscated code in client.py

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/917437dd48ecf7002fc00df80cdfe479ffbd4d9a/osv/malicious/pypi/tsshare/MAL-2026-16044.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/917437dd48ecf7002fc00df80cdfe479ffbd4d9a/osv/malicious/pypi/tsshare/MAL-2026-16044.json
- https://github.com/ossf/malicious-packages/blob/83eaa0ea06a568f056a7ad5ad945c5bdf1e64840/osv/malicious/pypi/tsshare/MAL-2026-16044.json
- https://pypi.org/project/tsshare/1.0.19
- https://github.com/ossf/malicious-packages/blob/acc4e60ebc20dd2e9427ebbe173aaa9dafd35166/osv/malicious/pypi/tsshare/MAL-2026-16044.json
- https://research.codelake.dev/advisories/clr-2026-3053-tsshare
- https://github.com/ossf/malicious-packages/blob/11f396503db37dd34b82fdc5035eb4c6a6297734/osv/malicious/pypi/tsshare/MAL-2026-16044.json
- https://pypi.org/project/tsshare/1.0.1
- https://pypi.org/project/tsshare/1.0.10

Compromised versions (1)

• = 1.0.19

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.