Critical Malicious Code Vulnerability in aseitylab Package
Summary
MAL-2026-17240: Malicious code in aseitylab (PyPI). Affects aseitylab versions 0.1.0 – 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aseitylab package is a pure-Python task-orchestration toolkit available on PyPI, designed to facilitate task management without runtime dependencies. However, it has been found to contain malicious code that executes arbitrary payloads upon installation and import, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from the inclusion of a large base85-encoded, zlib-compressed blob in the aseitylab package. This blob is decoded and executed through the _ensure_compat() function defined in compat.py. The malicious payload runs during both installation and import of the package, allowing for arbitrary code execution. The execution is conditionally gated by environment variables, but the presence of such a payload undermines the integrity of the package and can lead to severe security breaches, including data theft and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aseitylabIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can set the environment variable ASEITYLAB_COMPAT to 0 and DAS_STAGED to 1 during installation or import to suppress the execution of the malicious payload. However, this does not eliminate the risk and should not be considered a permanent solution.
Conclusion
The aseitylab package contains a critical vulnerability that allows for the execution of malicious code upon installation and import. Users are strongly advised to update to the latest version and consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for aseitylab →
FAQ
aseitylab is a task-orchestration toolkit designed for Python, aimed at managing tasks without requiring additional runtime dependencies.
The vulnerability allows for arbitrary code execution, which can lead to data theft, system compromise, and other malicious activities.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring signup.
Setting the environment variables ASEITYLAB_COMPAT to 0 and DAS_STAGED to 1 can suppress the execution of the malicious payload, but it is not a permanent fix.
If you have installed an affected version of aseitylab, immediately update to the latest patched version using pip install --upgrade aseitylab.
