Malicious Code Vulnerability in ariadne-federation Package
Summary
MAL-2026-1431: Malicious code in ariadne-federation (PyPI). Affects ariadne-federation versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ariadne-federation package is a Python library designed for building GraphQL APIs with support for federation. It allows developers to create modular and scalable GraphQL services. However, this package has been found to contain a serious vulnerability that compromises its integrity and security.
Vulnerability Detail
The vulnerability originates from a malicious code embedded within the ariadne-federation package. During the import process, the package decrypts and executes a hidden malicious executable that is encoded and obfuscated within a JSON resource file. This poses significant risks, including data theft and unauthorized access to sensitive information. The campaign associated with this vulnerability is part of a broader malicious initiative targeting Python packages, specifically identified as 2026-03-ariadne-federation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ariadne-federationIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the ariadne-federation package until a secure version is released. If you must use it, consider isolating it in a controlled environment to mitigate potential risks.
Conclusion
The ariadne-federation package has been identified as containing a serious vulnerability that allows for the execution of malicious code. It is essential for users to update to a secure version and to monitor their applications for potential impacts. Utilizing tools like Vulert can aid in real-time vulnerability monitoring.
See every vulnerability recorded for ariadne-federation →
FAQ
The vulnerability involves malicious code that executes during the import of the package, leading to potential data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
If you have installed the affected version, immediately update the package to the latest secure version using pip install --upgrade ariadne-federation.
Yes, you can isolate the package in a controlled environment to limit exposure until a secure version is available.
The vulnerability was reported by Kamil Mańkowski (kam193), who is actively monitoring and reporting on malicious packages.
