Malicious Code Vulnerability in asurion Package - Exfiltration of Host Information
Summary
MAL-2026-18045: Malicious code in asurion (PyPI). Affects asurion versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The asurion package, available on PyPI, is designed for specific functionalities related to data handling. However, it has been identified as a malicious package that serves no legitimate purpose other than to exfiltrate sensitive information from the host system. This vulnerability poses a risk to users who install or import the package, as it can lead to unauthorized data access.
Vulnerability Detail
The vulnerability originates from the package's design, which includes code that exfiltrates basic information about the host, such as the IP address and username. The malicious behavior is triggered during the installation process, where the package overrides the install command in setup.py to execute harmful code. This poses a limited risk but can still compromise user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall asurionIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid installing the asurion package. If it has already been installed, remove it using the command: 'pip uninstall asurion'. Additionally, consider using a virtual environment to isolate your projects and minimize the impact of malicious packages.
Conclusion
The asurion package has been identified as a malicious entity that exfiltrates sensitive information from the host system. Users are advised to uninstall the package immediately and monitor for updates or patches. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for asurion →
FAQ
The asurion package is a Python package available on PyPI, but it has been identified as malicious and is designed to exfiltrate sensitive information from the host system.
The vulnerability manifests during the installation of the package, where it executes code that collects and sends basic host information to an external source.
If you have installed the asurion package, you should uninstall it immediately using the command 'pip uninstall asurion'.
Currently, there is no patched version available for the asurion package. Users should avoid using it until a secure version is released.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup at Vulert Scanner.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
