Malicious Code Vulnerability in accesspdp Package: Exfiltration of Host Information
Summary
MAL-2025-193006: Malicious code in accesspdp (PyPI). Affects accesspdp versions 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The accesspdp package, available on PyPI, is designed for specific functionalities related to access control policies. However, it has been identified to contain malicious code that compromises user security by exfiltrating sensitive information from the host system. This vulnerability poses a significant risk to users who install or import the package, as it executes harmful actions without their consent.
Vulnerability Detail
The vulnerability originates from malicious code embedded in the accesspdp package, specifically in version 2.0.1. Upon installation or import, the package exfiltrates basic information about the host, such as the IP address and username. The malicious behavior is triggered by overriding the install command in setup.py, allowing the code to execute during the installation process. This poses a risk of unauthorized data access and potential exploitation by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall accesspdpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid installing the accesspdp package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The accesspdp package contains a serious vulnerability that allows for the exfiltration of sensitive host information. Users are advised to uninstall the package and refrain from using it until a secure version is released. Monitoring for updates and using alternative packages is recommended to ensure security.
See every vulnerability recorded for accesspdp →
FAQ
The accesspdp package is a Python library available on PyPI that is intended for managing access control policies.
The vulnerability allows the package to exfiltrate sensitive information from the host system, such as IP addresses and usernames, without user consent.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Currently, there is no patched version of the accesspdp package available. Users should monitor the package repository for updates.
If you have installed accesspdp, it is recommended to uninstall it immediately using the command pip uninstall accesspdp.
