pypi / topos-node / 1.5.45

topos-node 1.5.45

Riskcritical Vulnslow

processes: 835
operations: 300K
packages: 139
compiler runs: 3
connections: 9
build time: 6m 05s
job time: 6m 05s
capture: 4.6 MB
records: 566K
bytes / record: 8.2

run 20a3d997-4e37-456a-bf6d-15d03272c298 · built 2026-11-06 · complete View on PyPI Release

Graph

secret-exfil · critical

Checks

15 of 19 clear Network activity Sensitive data access and transfer +2 more

Build behavior▲▲✓✓✓✓✓✓✓✓✓

Supply chain▲▲✓✓✓✓✓

Pipeline✓

Detections

Credential store contents reached a network peer

cas-server.xethub.hf.co:443 › cas-server.xethub.hf.co:443

critical
Credential store contents reached a network peer

cp.logu3s.com:443 › cp.logu3s.com:443

critical
Credential store contents reached a network peer

huggingface.co:443 › huggingface.co:443

critical
Package code connected to an undeclared host

cas-server.xethub.hf.co:443 › cas-server.xethub.hf.co:443, pypi.org

medium
Package code dialled an undeclared host, and nothing answered

files.pythonhosted.org:443 › files.pythonhosted.org:443, pypi.org

medium
Package code connected to an undeclared host

huggingface.co:443 › huggingface.co:443, pypi.org

medium
Package code connected to an undeclared host

us.aws.cdn.hf.co:443 › us.aws.cdn.hf.co:443, pypi.org

medium

Network

9 peers

cas-server.xethub.hf.co:443 topos-node's own build code · python3.14 (topos-node); topos-node · Amazon.com, Inc. unjudged
cp.logu3s.com:443 topos-node's own build code · python3.14 (topos-node) · Cloudflare, Inc. unjudged
files.pythonhosted.org:443 topos-node's own build code · python3.14 (topos-node); topos-node unjudged
github.com:443 topos-node's own build code · curl · Microsoft Corporation unjudged
huggingface.co:443 topos-node's own build code · python3.14 (topos-node); topos-node · Amazon.com, Inc. unjudged
ollama.com:443 topos-node's own build code · curl · Google LLC unjudged
release-assets.githubusercontent.com:443 topos-node's own build code · curl · Fastly, Inc. unjudged
us.aws.cdn.hf.co:443 topos-node's own build code · topos-node · Amazon.com, Inc. unjudged
files.pythonhosted.org:8080 the package manager · python3.14 (topos-node) via pypi.org ecosystem

Vulnerabilities9		Fix	Severity
Dependencies
pip 25.1.1		>=26.2.0
CVE-2025-8869	pip's fallback tar extraction doesn't check symbolic links point to extraction directory		medium
CVE-2026-13346	pip would incorrectly handle doubly-encoded package URLs from indexes		medium
CVE-2026-3219	pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files		medium
CVE-2026-6357	pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere		medium
CVE-2026-8643	pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory		medium
CVE-2026-1703	pip Path Traversal vulnerability		low
setuptools 81.0.0		>=84.1.0
CVE-2026-59890	setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+		medium
GHSA-xmj3-9gf7-h52w	setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description		low
torch 2.12.1		>=2.13.0
CVE-2025-3000	PyTorch is vulnerable to memory corruption through its torch.jit.script function		low

Dependencies139	Build behaviour
annotated-doc0.0.5
annotated-types0.8.0
anyio4.16.0
asgi-lifespan2.1.0
attrs26.1.0
build1.6.1
certifi2026.10.23
cffi2.1.1
charset-normalizer3.5.2
click8.4.2
cloudpickle3.1.2
cryptography50.0.2
cuda-bindings13.5.0
cuda-pathfinder1.8.6
cuda-toolkit13.0.2
duckdb1.5.6
fastapi0.136.3
filelock4.2.9
fsspec2026.9.0
google-api-core2.44.0
google-auth2.62.1
google-cloud-core2.8.0
google-cloud-run0.16.2
google-cloud-storage3.10.1
google-crc32c1.9.0
google-resumable-media2.11.0
googleapis-common-protos1.76.0
grand-cypher0.13.0
grandiso2.2.0
grpc-google-iam-v10.14.6
grpcio1.85.1
grpcio-status1.85.1
h110.16.0
hf-xet1.5.2
httpcore1.0.9
httptools0.9.0
httpx0.28.1
httpx-sse0.4.3
huggingface-hub1.18.0
hypothesis6.170.15
idna3.20
iniconfig2.3.1
jinja23.1.6
joblib1.6.0
jsonschema4.26.0
jsonschema-specifications2025.9.1
lark1.3.1
markdown-it-py4.2.0
markupsafe3.0.4
mcp1.30.0
mdurl0.1.2
mpmath1.3.0
narwhals2.28.0
networkx3.6.1
numpy2.5.4
nvidia-cublas13.1.1.3
nvidia-cuda-cupti13.0.85
nvidia-cuda-nvrtc13.0.88
nvidia-cuda-runtime13.0.96
nvidia-cudnn-cu139.20.0.48
nvidia-cufft12.0.0.61
nvidia-cufile1.15.1.6
nvidia-curand10.4.0.35
nvidia-cusolver12.0.4.66
nvidia-cusparse12.6.3.3
nvidia-cusparselt-cu130.8.1
nvidia-nccl-cu132.29.7
nvidia-nvjitlink13.0.88
nvidia-nvshmem-cu133.4.5
nvidia-nvtx13.0.85
opentelemetry-api1.45.2
opentelemetry-exporter-http-transport0.66b2
opentelemetry-exporter-otlp-common0.66b2
opentelemetry-exporter-otlp-proto-common1.45.2
opentelemetry-exporter-otlp-proto-http1.45.2
opentelemetry-proto1.45.2
opentelemetry-sdk1.45.2
opentelemetry-semantic-conventions0.66b2
packaging26.1
pillow13.0.0
pluggy1.7.0
proto-plus1.29.0
protobuf7.36.2
psycopg3.3.8
psycopg-binary3.3.8
pyasn10.6.5
pyasn1-modules0.4.2
pycparser3.12
pydantic2.13.5
pydantic-core2.46.5
pydantic-settings2.15.0
pygments2.21.0
pyjwt2.15.1
pyproject-hooks1.3.3
pystray0.19.5
pytest9.0.3
pytest-asyncio1.3.0
python-dotenv1.2.4
python-louvain0.16
python-multipart0.0.32
python-xlib0.33
pytypedstream0.1.0
pyyaml6.0.3
referencing0.37.0
regex2026.9.29
requests2.34.2
rich15.0.0
rpds-py2026.9.1
safetensors0.8.0
scikit-learn1.9.1
scipy1.18.1
sentence-transformers5.6.1
shellingham1.5.4
six1.17.0
sniffio1.3.1
sortedcontainers2.4.0
sqlite-vec0.1.9
sse-starlette3.6.0
starlette1.10.0
sympy1.14.0
threadpoolctl3.8.0
tokenizers0.22.2
torch2.12.1
tqdm4.67.3
transformers5.10.4
triton3.7.1
typer0.25.1
typing-extensions4.16.0
typing-inspection0.4.5
urllib32.8.0
uvicorn0.44.0
uvloop0.23.0
watchfiles1.3.0
websockets16.0
pip25.1.1
pip26.3
setuptools81.0.0
wheel0.48.0
~ackaging26.3

Versions136

1 of 1 jobs captured: build-import success · Generated 2026-11-06 · run 20a3d997-4e37-456a-bf6d-15d03272c298

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2

topos-node's one-click Ollama installer runs a remote script without pinning or verifying it

Conclusion: unverified-download
Covers: 1.5.45
Reviewed by: Bitbison
Updated: 2026-11-06

topos-node is a personal AI engine whose one-click Ollama installer fetches and runs https://ollama.com/install.sh without a pinned version, hash or signature.

topos-node is the Topos personal AI engine: a local FastAPI service that stores personal data, syncs with the Topos control plane over a WebSocket, and runs local language models. It is not malicious — the connections it makes are to its own backend and to Hugging Face. The problem is its one-click Ollama installer, which downloads and executes a remote install script with no pinning and no verification. The package first appeared on PyPI on June 01, 2026; version 1.5.45 was published on November 06, 2026 and is still served.

What topos-node does

When installed, topos-node runs a local node (FastAPI) on 127.0.0.1:8676. On startup it connects to its control plane at wss://cp.logu3s.com/ws/engine and syncs over wss://cp.logu3s.com/ws/sync, authenticating with a Bearer token it reads from its own credential file at ~/.topos/.env. It downloads embedding and reranking models from Hugging Face (huggingface.co and its xet/CDN hosts). It checks pypi.org for new versions of itself and can self-update with uv, and it offers a one-click install of Ollama for local inference.

What the code does

topos/defaults.py:10 sets the control plane URL to wss://cp.logu3s.com/ws/engine.
topos/config/settings.py:230 defaults sync to wss://cp.logu3s.com/ws/sync.
topos/owner_key.py:30,84-92 mints a TOPOS_OWNER_KEY and writes it into ~/.topos/.env (mode 0600); the module docstring states this key is for the node's own direct-HTTP surface and never crosses the wire.
topos/cli/commands.py:34,75-156 read and save TOPOS_KEY in ~/.topos/.env.
topos/control_plane_client.py:430,443 sends TOPOS_KEY only as an Authorization: Bearer header to the control plane.
topos/engine/backends/huggingface.py:330-335 downloads models with huggingface_hub.snapshot_download.
topos/runtime_update.py:73-80 checks pypi.org/pypi/topos-node/json, and self-update applies via uv tool upgrade.
topos/engine/ollama_install.py:91-95 runs bash -c "curl -fsSL https://ollama.com/install.sh | sh" — no exact version, no hash checked, no signature verified.
topos/core/handlers/device.py:776-782 wires the ollama_install message to start_install; on Linux and Windows start_install refuses and returns manual instructions (topos/engine/ollama_install.py:181-217), so the script runs only on macOS.

Timeline (UTC)

When	What
June 01, 2026	First version published on PyPI
November 06, 2026 14:42	Version 1.5.45 published
November 06, 2026	Still served; version 1.5.45 has been up for about five hours

If you installed it

The unpinned install script runs only when the owner clicks the one-click Ollama install, and only on macOS; on Linux and Windows the install path refuses and shows manual instructions. If you use Topos, install Ollama yourself through your package manager or by downloading the official installer and verifying its checksum rather than through the one-click path. Uninstalling topos-node removes the node; its data lives under ~/.topos.

Indicators

hosts: cp.logu3s.comhuggingface.cocas-server.xethub.hf.cous.aws.cdn.hf.cofiles.pythonhosted.orgpypi.orgollama.com
files: ~/.topos/.env
processes: curl -fsSL https://ollama.com/install.sh

What was examined

1.5.45: sha256:1c6b84bb9618a9b7d6204a4ff642ab315b00e4038b0ab75651e400f6120b6733