Malicious Code Exploit in apachelicense Package: Data Theft Vulnerability
Summary
MAL-2026-2119: Malicious code in apachelicense (PyPI). Affects apachelicense versions 0.1a1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The apachelicense package, available on PyPI, is a malicious clone of the legitimate 'license' package. It is designed to perform operations related to software licensing but has been compromised to include harmful code. This vulnerability allows attackers to exploit the package for data theft, particularly targeting sensitive information from users' cryptowallets and password managers.
Vulnerability Detail
The vulnerability originates from a malicious clone of the legitimate 'license' package, created by the user 'kam193'. When the find_by_key function is invoked, it loads strongly obfuscated malicious code that collects sensitive data from users' cryptowallets and password managers. This data is then exfiltrated to a hardcoded remote location. Prior to version 0.1b2, the malicious code was hosted externally and downloaded upon triggering, increasing the risk of exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall apachelicenseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the apachelicense package altogether. If you need licensing functionality, consider using the legitimate 'license' package instead. You can install it using the command: 'pip install license'.
Conclusion
The apachelicense package poses a significant risk due to its malicious intent and capability to exfiltrate sensitive data. It is crucial for users to uninstall this package and utilize legitimate alternatives to safeguard their information. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for apachelicense →
FAQ
The apachelicense package is a malicious clone of the legitimate 'license' package, designed to perform operations related to software licensing but compromised to steal sensitive data.
The vulnerability activates when the find_by_key function is called, loading obfuscated malicious code that collects sensitive information from cryptowallets and password managers.
You should uninstall the apachelicense package immediately using the command 'pip uninstall apachelicense' and consider using the legitimate 'license' package.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Using compromised packages can lead to data theft, loss of sensitive information, and potential security breaches in your applications.
