Malicious Code Vulnerability in aitrade Package on PyPI
Summary
MAL-2026-1893: Malicious code in aitrade (PyPI). Affects aitrade versions 0.1.2 – 0.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aitrade package is a Python library available on the Python Package Index (PyPI) designed for trading and financial analysis. It offers various functionalities to facilitate automated trading strategies. However, recent findings have revealed that certain versions of this package contain malicious code, posing significant security risks to users who integrate it into their applications.
Vulnerability Detail
The vulnerability identified in the aitrade package stems from the inclusion of malicious code that can compromise the security of systems utilizing this library. This code may lead to unauthorized access, data breaches, or other harmful actions. The affected versions, specifically 0.1.2 and 0.1.3, were flagged by security researchers from ReversingLabs, indicating a serious threat to users who have installed these versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aitradeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to uninstall the affected versions of the aitrade package. This can be done using the command: 'pip uninstall aitrade'. Consider using alternative libraries for trading until a secure version of aitrade is confirmed.
Conclusion
The aitrade package has been identified as containing malicious code in specific versions, posing a serious security risk to users. It is crucial to update to a secure version or consider alternative libraries to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for aitrade →
FAQ
The affected versions are 0.1.2 and 0.1.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should uninstall the affected version and update to a secure version of the aitrade package.
The vulnerability was reported by ReversingLabs, a security research firm.
Using the affected package may lead to unauthorized access to your system, data breaches, and other security threats.
