Malicious Code Detected in aniresolve Package - Potential Infostealer Threat
Summary
MAL-2026-1543: Malicious code in aniresolve (PyPI). Affects aniresolve versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aniresolve is a Python package available on PyPI that is designed for resolving various data types and formats. It is commonly used in applications that require data manipulation and retrieval. However, recent findings have revealed that this package is compromised, harboring malicious code that poses significant security risks to users and their systems.
Vulnerability Detail
The vulnerability originates from a malicious code embedded within the aniresolve package, specifically in version 0.0.1. This code is designed to download and execute a remote executable, which is likely an infostealer. The malicious code is not directly invoked within the package, indicating that it may rely on dependencies or serve as a subsequent stage in a broader infection chain. The implications of this vulnerability are severe, as it can lead to unauthorized access to sensitive information and compromise the integrity of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aniresolveIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to uninstall the aniresolve package until a secure version is released. This can be done using the command: pip uninstall aniresolve.
Conclusion
The discovery of malicious code within the aniresolve package highlights the importance of vigilance in open-source software usage. Users must take immediate action to protect their systems by uninstalling the compromised package and monitoring for updates. Utilizing tools like Vulert can aid in identifying vulnerabilities in real-time.
See every vulnerability recorded for aniresolve →
FAQ
aniresolve is a Python package used for resolving various data types and formats, commonly utilized in data manipulation applications.
The malicious code is designed to download and execute an infostealer, which can compromise sensitive information and system integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The best protection is to uninstall the aniresolve package until a patched version is available. Regularly monitor for updates and apply them promptly.
If you have installed the compromised version of aniresolve, it is crucial to uninstall it immediately and refrain from using it until a secure version is released.
