Critical Malicious Code Vulnerability in auclean Package
Summary
MAL-2026-16410: Malicious code in auclean (PyPI). Affects auclean versions 0.4.2 – 0.4.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The auclean package, available on PyPI, is designed for pure-Python audio digital signal processing (DSP) using libraries like numpy, wave, and soundfile. However, it has been found to contain a malicious executable that runs during installation, compromising user environments and potentially leading to credential theft.
Vulnerability Detail
The vulnerability originates from the installation process of auclean version 0.4.2, where a custom setup.py script executes a bundled Rust ELF binary. This binary, which is unrelated to the package's stated functionality, performs various malicious actions such as environment fingerprinting, searching for sensitive files, and exfiltrating cloud credentials. The package also downloads additional malicious content from an attacker-controlled CDN, further enhancing its threat profile.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aucleanIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid installing the auclean package until a secure version is released. If you have already installed it, consider removing it using the command: pip uninstall auclean.
Conclusion
The auclean package has been identified as containing malicious code that poses significant security risks to users. It is essential to avoid using this package until a secure version is released and to monitor your systems for any potential breaches.
See every vulnerability recorded for auclean →
FAQ
The auclean package is intended for audio digital signal processing in Python, utilizing libraries like numpy and soundfile.
The vulnerability manifests during installation when a malicious binary is executed, which can lead to credential theft and other malicious activities.
If you have installed auclean, it is recommended to uninstall the package immediately and monitor your environment for any suspicious activity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, the auclean package has been reported to fingerprint environments, search for sensitive files, and exfiltrate cloud credentials, indicating a serious security risk.
