AIKIDO-2026-10653

TL;DR

Affected versions of this package may expose sensitive information in its package index authentication handling. Credentials embedded in [[source]] URLs within Pipfiles were passed directly to pip as -i and --extra-index-url command-line arguments, causing usernames, passwords, or tokens to be exposed through local process inspection interfaces such as ps, process listings, and /proc/<pid>/cmdline. A local attacker or co-located user on the same system could obtain private repository credentials and use them to access internal package indexes or other protected resources.