Malicious Code Exploit in auto-backup-wsl Package - Data Exfiltration Risk
Summary
MAL-2026-926: Malicious code in auto-backup-wsl (PyPI). Affects auto-backup-wsl versions 1.0.0 – 1.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The auto-backup-wsl package, available on PyPI, is designed to perform backups of files to a remote location. However, it has been found to have a significant security flaw that allows malicious actors to exfiltrate sensitive user data without consent. The package operates by uploading files to a hardcoded Gofile account, leaving users with no control over their data or knowledge of where it is being sent.
Vulnerability Detail
The vulnerability originates from the package's design, which lacks user control over the remote backup location. It exfiltrates sensitive information such as passwords, mnemonics, keys, crypto tokens, command history, and clipboard content. The malicious intent is evident as the package is often integrated into cryptocurrency-related repositories, automatically executing scheduled tasks that compromise user security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall auto-backup-wslIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can disable any scheduled tasks or services that invoke the auto-backup-wsl package. This can be done by accessing the task scheduler on their operating system and removing any entries related to the package.
Conclusion
The auto-backup-wsl package poses a significant risk due to its malicious functionality that exfiltrates sensitive user data. Users are advised to uninstall the package and monitor their systems for any unauthorized activities. Utilizing tools like Vulert can help in maintaining security by providing real-time vulnerability alerts.
See every vulnerability recorded for auto-backup-wsl →
FAQ
auto-backup-wsl is a Python package designed to back up files to a remote location, but it has been compromised to exfiltrate sensitive data.
The vulnerability allows the package to upload sensitive information, including passwords and crypto tokens, to a hardcoded remote location without user consent.
Uninstall the auto-backup-wsl package immediately and check for any scheduled tasks that may be running it.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time without requiring access to the code. You can check your application using the Vulert playground.
Regularly update your packages, monitor for vulnerabilities using tools like Vulert, and review your scheduled tasks for any unauthorized entries.
