fluenceenergy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Mooncake integration. An attacker can execute arbitrary code by sending malicious payloads to a pickle based deserialization method over unsecured ZeroMQ sockets.

Note: This is only exploitable if the vLLM instance is configured to use the mooncake integration.

Affected versions of this package are vulnerable to Insecure Randomness due to its use of the hexoid() function in the generation of fingerprint IDs.