Malicious Code Vulnerability in bigpyx Package
Summary
MAL-2025-192430: Malicious code in bigpyx (PyPI). Affects bigpyx versions 0.0.1 – 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The bigpyx package, available on PyPI, is designed for specific functionalities within Python applications. However, it has been identified as containing malicious code that can compromise user systems. This vulnerability is part of a broader campaign that exploits obfuscation techniques to hide its true intent, which includes downloading and executing harmful scripts.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2025-12-graphnode'. The malicious code is obfuscated to evade detection and is capable of downloading and executing remote scripts. This poses significant risks, including data theft and unauthorized access to user systems. The affected versions of the bigpyx package are 0.0.1 and 0.0.2, both of which contain the malicious payload.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall bigpyxIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can uninstall the bigpyx package to prevent any malicious activity. This can be done using the command: 'pip uninstall bigpyx'. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The bigpyx package has been identified as containing malicious code that poses significant risks to users. It is essential to update the package to a safe version or uninstall it to prevent potential harm. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for bigpyx →
FAQ
bigpyx is a Python package available on PyPI, designed for specific functionalities within Python applications.
The malicious code obfuscates its true intent and downloads harmful scripts from remote locations, potentially compromising user systems.
The affected versions of the bigpyx package are 0.0.1 and 0.0.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
If immediate updates are not possible, uninstall the bigpyx package to mitigate risks until a safe version is available.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
