Confirmed malicious. Do not install it, and remove it where it has been installed.
Malicious package. Confirmed 2024-06-25, OSV malicious-package feed (Google / OpenSSF).
The publishing source recorded this as malicious without a public write-up.
Remove it from every machine and lockfile it reached. Treat any credentials, tokens and SSH keys present on those machines as exposed and rotate them. Check CI runners and container images that installed it.
pip uninstall sentinelonesdk
0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
No published models are known to use this package.
severity band, no base score published
chance of exploitation in 30 days
CyberXYZ composite out of 10
fig. 01 — GHSA-g86j-hwg9-77q5, the advisory selected below
In December 2022, threat actors impersonated SentinelOne by uploading fake software development kits (SDKs) onto PyPI. The SDKs contain fully functional SentinelOne clients, but the packages also contained malicious backdoors that are only executed when called on programmatically, as opposed to during installation. The packages have since been taken down from PyPI.
Checked 2026-10-23 at 18:51 UTC. The most recent advisory here was published 2022-12-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.