nvidia-nat-semantic-kernel

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fe66a4b0f7f00b8e8a9abd877b3ab0531d56906cc11f6fa6ecaddd4b0bebbbe1)
The package's METADATA declares `Requires-Dist: ruamel-yaml-clibz==0.3.5`, a typosquat of the well-known `ruamel-yaml-clib` (note the trailing 'z'). Installing nvidia-nat-semantic-kernel via pip will silently resolve and install ruamel-yaml-clibz from PyPI, bringing whatever code that lookalike package ships into the installer's environment. The substitution is inconsistent with the rest of the dependency list, which uses standard upstream names, and ruamel-yaml-clib (without the z) is the canonical C-extension companion to ruamel.yaml that the YAML stack normally requires. This is the dependency-confusion / pull-through-typosquat pattern: the host package is the vector, and the harm arrives through the named transitive.

Compromised versions (3)

• 1.8.0a20260521
• 1.8.0a20260607
• 1.9.0a20260611

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.