zju3dv/easymocap

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  myeasymocap/backbone/vitpose/vit_moe.py:544
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/datasets/base.py:520
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/pipeline/__init__.py:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/mytools/triangulator.py:477
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/mytools/triangulator.py:481
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  scripts/preprocess/extract_video.py:127
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/datasets/base.py:520
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/pipeline/__init__.py:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/mytools/triangulator.py:477
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  easymocap/mytools/triangulator.py:481
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  scripts/preprocess/extract_video.py:127
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2022-0845 Code Injection in PyTorch Lightning
  requirements.txt
  A package you depend on has a known security hole (CVE-2022-0845). Fix: Update that package to its patched version.
• Serious CVE-2024-8019 PyTorch Lightning path traversal vulnerability
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-8019). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-4118 pytorch-lightning is vulnerable to Deserialization of Untrusted Data
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-4118). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-40897 pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py
  requirements.txt
  A package you depend on has a known security hole (CVE-2022-40897). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-6345 pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-6345). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-47273 setuptools: Path Traversal Vulnerability in setuptools PackageIndex
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-47273). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-59890 setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-59890). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2022-181 Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2022-0845). Fix: Update that package to its patched version.
• Serious PYSEC-2026-507 PyTorch Lightning path traversal vulnerability
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2024-8019). Fix: Update that package to its patched version.
• Serious PYSEC-2022-181 Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2022-0845). Fix: Update that package to its patched version.
• Serious PYSEC-2026-507 PyTorch Lightning path traversal vulnerability
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2024-8019). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-47268 In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/3rdparty/eigen-3.3.7
  A package you depend on has a known security hole (CVE-2023-47268). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-874 pytorch-lightning is vulnerable to Deserialization of Untrusted Data
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2021-4118). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1857 PyTorch Lightning denial of service vulnerability
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2024-8020). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3043 PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2026-31221). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2022-43012 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2022-40897). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2025-49 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to versio
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2025-47273). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1918 setuptools vulnerable to Command Injection via package URL
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2024-6345). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3447 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude,
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements.txt
  A package you depend on has a known security hole (CVE-2026-59890). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-874 pytorch-lightning is vulnerable to Deserialization of Untrusted Data
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2021-4118). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1857 PyTorch Lightning denial of service vulnerability
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2024-8020). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3043 PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2026-31221). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2022-43012 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2022-40897). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2025-49 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to versio
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2025-47273). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1918 setuptools vulnerable to Command Injection via package URL
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2024-6345). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3447 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude,
  /workdirs/scan-881cba12-2d65-4528-a91d-c8e18e90ea8b/requirements_neuralbody.txt
  A package you depend on has a known security hole (CVE-2026-59890). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

• Serious guarddog-pypi-code-execution code-execution match in ultralytics 8.4.107
  ultralytics
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
• Worth fixing guarddog-pypi-shady-links shady-links match in tqdm 4.69.1
  tqdm
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
• Worth fixing guarddog-pypi-shady-links shady-links match in pytorch-lightning 1.5.0
  pytorch-lightning
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
• Worth fixing guarddog-pypi-shady-links shady-links match in setuptools 59.5.0
  setuptools
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0