AVID-2026-R1161

Description

Vulnerability CVE-2022-42041

Details

The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected version is 0.1.0.

Reason for inclusion in AVID: CVE-2022-42041 describes a backdoored Python package (d8s-file-system) distributed via PyPI, with a potential code-execution backdoor introduced by a third party (democritus-hashes). The vulnerability is in a software supply chain artifact (a Python dependency) that could be used in AI software stacks and pipelines, posing a security risk to general-purpose AI systems. The description provides explicit evidence of a code-execution backdoor and affected version 0.1.0, with references to reliable sources (NVD, PyPI pages). This constitutes a software supply-chain security vulnerability relevant to AI systems.

References

• NVD entry
• https://pypi.org/project/d8s-file-system/
• https://pypi.org/project/democritus-hashes/
• https://github.com/dadadadada111/info/issues/2

Affected or Relevant Artifacts

• Developer: n/a
• Deployer: n/a
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-10-11
• Version: 0.3.3
• AVID Entry