CVE-2022-41385: 
Python vulnerability analysis and mitigation

The d8s-html package for Python, as distributed on PyPI version 0.1.0, contained a potential code-execution backdoor inserted by a third party. The backdoor was implemented through the democritus-urls package (CISA Bulletin, NVD).

The vulnerability was discovered in version 0.1.0 of the d8s-html package. The malicious code was inserted through a dependency package called democritus-urls, which could allow attackers to upload packages containing arbitrary malicious code. The vulnerability has been assigned a CVSS score of 9.8, indicating critical severity (CISA Bulletin).

The backdoor could allow attackers to execute arbitrary code through the compromised package. When users install d8s-html version 0.1.0 using pip, the malicious democritus-urls package would be installed as a dependency, potentially giving attackers control over the affected systems (GitHub Issue).

Users should avoid using version 0.1.0 of the d8s-html package. The recommendation is to remove version 0.1.0 from PyPI to prevent further installations of the compromised package (GitHub Issue).