Malicious Code Exfiltration in anduril-lattice-sdk-grpc-python Package
Summary
MAL-2026-440: Malicious code in anduril-lattice-sdk-grpc-python (PyPI). Affects anduril-lattice-sdk-grpc-python versions 2.0.0 – 99.99.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The anduril-lattice-sdk-grpc-python package is a Python library hosted on PyPI, designed for gRPC communication in the Anduril Lattice framework. It is intended for developers looking to integrate Anduril's capabilities into their applications. However, this package has been identified to contain malicious code that compromises user data.
Vulnerability Detail
The vulnerability originates from the package's design, which includes code that exfiltrates basic information about the host system, such as the IP address and username, upon installation or import. The malicious behavior is executed by overriding the install command in the setup.py file, allowing it to run harmful code during the installation process. This poses a risk of unauthorized data access and potential exploitation of the user's environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall anduril-lattice-sdk-grpc-pythonIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the anduril-lattice-sdk-grpc-python package altogether and look for alternative libraries that provide similar functionality without the associated risks.
Conclusion
The anduril-lattice-sdk-grpc-python package has been identified to contain malicious code that compromises user data. It is crucial for developers to be aware of such vulnerabilities and take appropriate actions to protect their systems. Uninstalling the affected package and monitoring for updates are essential steps in maintaining security.
See every vulnerability recorded for anduril-lattice-sdk-grpc-python →
FAQ
The primary risk is the unauthorized exfiltration of sensitive information from the host system, which can lead to privacy breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed the affected package, you should uninstall it immediately and consider using a secure alternative.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the Pipfile.lock, making it easier to stay informed.
While many packages on PyPI are trustworthy, it is essential to review the package's code and reputation before installation, as vulnerabilities can exist.
