Malicious Code Detected in cflashfiles Package: Exfiltration Risk
Summary
MAL-2026-469: Malicious code in cflashfiles (PyPI). Affects cflashfiles versions 2.1 – 2.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cflashfiles package, available on PyPI, is a malicious clone of the legitimate fsspec package. It was designed to provide similar functionalities but has been compromised to include harmful code. This package is intended for file system specification and manipulation, but due to its malicious nature, it poses significant risks to users who may unknowingly install it.
Vulnerability Detail
The vulnerability stems from the malicious modification of the cflashfiles package, which was created as a clone of the legitimate fsspec package. Upon import, the code is designed to exfiltrate specific files from the user's system, potentially leading to data breaches and unauthorized access to sensitive information. The malicious code was introduced by the source kam193, and the package has been identified as part of a campaign targeting users through deceptive means.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cflashfilesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the cflashfiles package altogether and rely on the legitimate fsspec package for their file system needs. Additionally, users should regularly monitor their systems for any unauthorized file access or data breaches.
Conclusion
The cflashfiles package poses a significant risk due to its malicious intent to exfiltrate files upon import. Users are strongly advised to uninstall this package and switch to the legitimate fsspec package to safeguard their systems. Regular monitoring and awareness of installed packages are crucial in maintaining security.
See every vulnerability recorded for cflashfiles →
FAQ
cflashfiles is a malicious clone of the legitimate fsspec package, designed to manipulate file systems but contains harmful code that exfiltrates files.
You can check your installed packages by running 'pip list' in your terminal. Look for 'cflashfiles' in the list.
Uninstall the cflashfiles package immediately using 'pip uninstall cflashfiles' and install the legitimate fsspec package instead.
The malicious code is triggered upon import of the package, which then exfiltrates specific files from the user's system to an external server.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
