Is dynamo-release safe?
Version 1.5.4 of dynamo-release was compromised (Multi-signal supply-chain anomaly (cross-signal auto)). Other versions are not flagged as malicious.
Do not install dynamo-release 1.5.4
HIGHanalyst verifiedMulti-signal supply-chain anomaly (cross-signal auto). Added to CyberXYZ 2026-06-10, verified by a CyberXYZ analyst.
- package contents+10
pickle deserialize of untrusted data
- package contents+45
.pth startup-hook carrying a runnable payload (exec/subprocess/network — persists across releases)
- wave member+30
member of campaign wave (script_hash, 19 pkgs, 19 suspicious)
- Malicious
- 1.5.4
- Move to
- 1.5.3 newest 1.x release, no known advisory
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
pip install "dynamo-release==1.5.3"
0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
No published models are known to use this package.
Checked 2026-10-31 at 00:02 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.