slimdx is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Mooncake integration. An attacker can execute arbitrary code by sending malicious payloads to a pickle based deserialization method over unsecured ZeroMQ sockets.

Note: This is only exploitable if the vLLM instance is configured to use the mooncake integration.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server.