Malicious Code Exploit in aseity Package: Infostealer Threat
Summary
MAL-2026-17200: Malicious code in aseity (PyPI). Affects aseity versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aseity package, available on PyPI, is designed for Python developers to facilitate various functionalities. However, it has been compromised, leading to a significant security vulnerability. The package's malicious version employs obfuscated code to execute harmful actions, including data theft and remote code execution.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2026-09-donutautosellsrc'. During installation, the aseity package uses obfuscated code to fetch hidden code embedded within an image. This code contains a native extension module that acts as an infostealer, collecting sensitive user data and exfiltrating it to a command-and-control (C2) server, which is derived from transaction history on the Polygon blockchain. The package also includes mechanisms to detect if it is running in a sandbox environment, making it more challenging to identify and mitigate.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aseityIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the aseity package until a secure version is released. Additionally, consider implementing security measures such as running applications in a controlled environment to limit exposure to potential threats.
Conclusion
The aseity package has been compromised, leading to a serious vulnerability that allows for data theft and remote code execution. Users are urged to update or remove the package immediately and to monitor their systems for any signs of compromise. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for aseity →
FAQ
The aseity package is a Python library available on PyPI, designed to provide various functionalities for developers.
The vulnerability allows malicious code to collect sensitive data from users and send it to a remote server, posing a significant security risk.
If you have installed the aseity package, you should update it immediately to the latest version or remove it until a secure version is available.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using your Pipfile.lock. You can check your application for vulnerabilities without signing up at the Vulert playground.
Signs of compromise may include unusual network activity, unexpected application behavior, or unauthorized access to sensitive data.
