Malicious Code Injection in aoohttp: Cryptomining Malware Detected
Summary
MAL-2026-37: Malicious code in aoohttp (PyPI). Affects aoohttp versions 3.13.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aoohttp package, available on PyPI, is intended for HTTP client functionalities in Python applications. However, it has been compromised to include malicious code that poses significant security risks. This vulnerability allows attackers to execute remote code, leading to unauthorized cryptomining activities on user systems.
Vulnerability Detail
The vulnerability originates from an obfuscated code within the aoohttp package that downloads an encrypted binary blob, which is malware designed to initiate cryptomining. Once executed, the malware uninstalls the aoohttp package and installs a legitimate version to obscure the infection. This type of attack is categorized as typosquatting, where malicious packages are disguised as legitimate ones to deceive users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aoohttpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the aoohttp package until the issue is resolved. Additionally, consider using alternative HTTP client libraries such as requests or httpx, which are known to be secure.
Conclusion
The aoohttp package has been compromised with malicious code that initiates cryptomining activities. Users are advised to uninstall the package and replace it with a legitimate version to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert is recommended to maintain application security.
See every vulnerability recorded for aoohttp →
FAQ
The aoohttp package is a Python library designed for making HTTP requests, similar to other libraries like requests.
Check for unusual CPU usage or processes related to cryptomining. Additionally, verify if the aoohttp package has been uninstalled and replaced with a legitimate version.
Uninstall the aoohttp package immediately and replace it with a verified version. Use 'pip uninstall aoohttp' followed by 'pip install aoohttp' to reinstall safely.
If your application uses the compromised aoohttp package, it may be executing malicious code, leading to unauthorized resource usage and potential data breaches.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground without needing to sign up.
