Malicious Code Vulnerability in Causal-Canvas Package
Summary
MAL-2026-1294: Malicious code in causal-canvas (PyPI). Affects causal-canvas versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Causal-Canvas is a Python package available on PyPI that is designed for creating causal diagrams and visualizations. It is intended for data scientists and researchers who need to represent causal relationships in their data analysis. However, the package has been identified as malicious due to its ability to exfiltrate sensitive information from the host system upon installation.
Vulnerability Detail
The vulnerability in the Causal-Canvas package arises from its malicious code that executes during installation. This code is designed to exfiltrate basic information about the host, such as the IP address and username, to a domain associated with malicious activities. The package overrides the install command in setup.py, ensuring that the malicious code runs without the user's consent. This poses a risk to users who may unknowingly install the package, leading to potential data breaches and privacy violations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall causal-canvasIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the effects of this vulnerability other than avoiding the installation of the Causal-Canvas package. Users should consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The Causal-Canvas package has been identified as malicious due to its ability to exfiltrate sensitive information from users' systems. It is essential for users to uninstall this package and seek secure alternatives. Regular monitoring of open-source dependencies using tools like Vulert can help prevent similar vulnerabilities in the future.
See every vulnerability recorded for causal-canvas →
FAQ
Causal-Canvas is a Python package for creating causal diagrams and visualizations, primarily used by data scientists and researchers.
The vulnerability allows the package to exfiltrate sensitive information from your system, such as your IP address and username, to a malicious domain.
If you have installed Causal-Canvas, you should uninstall it immediately using the command pip uninstall causal-canvas.
Yes, consider using other reputable packages for causal diagramming that do not have known vulnerabilities.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
