SHANKS · MAL-2026-19051 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
The module shanks/shanks.py, when imported, looks up the machine's public IP address and location from a geolocation service and posts the IP address, city, state, postal code, latitude and longitude, with an @everyone mention, to a hard-coded Discord webhook. The package describes itself only as "A small example pkg". Version examined: 0.0.4; sdist SHA-256 dc417305d4b083a60ffda7aa310952306258fc12afc536a0641fc4a79c95bed8.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.