This is an advisory for a malicious package.

We recommend immediate removal of malicious versions of this package. Safety Firewall is actively blocking installation and will help you identify any existing installations of the package.

Learn more

PyPI: get-root

GHSA-2h6g-gr32-j774

Safety vulnerability ID: SFTY-20240823-59550

## Source: kam193 (1cb448108b11968d4fb13e0d12a3c089afa7eaeb7b288d6bc8e022ff1f4dd34a) Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-simple-tests Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. --- Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/get-root/MAL-2024-12276.json))

PyPI

GHSA

Created at: Jul 21, 2026Updated at: Jul 21, 2026

Overview

Malicious code in get-root (PyPI)

Advisory

Malicious code in get-root (PyPI)

Affected Package

Affecting get-root package, versions

== 0.1

Also affects

---

How to Fix

We recommend updating get-root to the latest non-vulnerable version.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more