Malicious Code Execution in chacha-lite-encrypt Package
Summary
MAL-2026-1482: Malicious code in chacha-lite-encrypt (PyPI). Affects chacha-lite-encrypt versions 4.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The chacha-lite-encrypt package is a cryptographic library available on PyPI, designed to provide lightweight encryption using the ChaCha20 algorithm. It is often used in applications requiring secure data transmission. However, this package has been compromised, leading to significant security concerns for users relying on its functionality.
Vulnerability Detail
The vulnerability in the chacha-lite-encrypt package arises from malicious code embedded within the package. During the import process, the package decrypts and executes a hidden malicious executable, which is encoded and obfuscated in a JSON resource file. This vulnerability poses serious risks, including unauthorized access to sensitive information and potential system compromise. The malicious intent is evident, as it is part of a broader campaign targeting users through malware, obfuscation techniques, dependency confusion, and typosquatting.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall chacha-lite-encryptIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the chacha-lite-encrypt package until a secure version is confirmed. Alternatively, consider using other well-established cryptographic libraries that do not exhibit this vulnerability.
Conclusion
The chacha-lite-encrypt package has been compromised, leading to a serious vulnerability that allows malicious code execution. Users are strongly advised to update the package immediately and consider alternative libraries for encryption. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for chacha-lite-encrypt →
FAQ
The vulnerability involves the execution of a malicious executable during the import of the package, which can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If you have installed the package, it is crucial to update it immediately to the latest patched version using the command: pip install --upgrade chacha-lite-encrypt.
Yes, consider using other reputable cryptographic libraries such as PyCryptodome or cryptography, which are widely used and maintained.
Failure to address this vulnerability can lead to unauthorized access to sensitive data, system compromise, and potential exploitation by malicious actors.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
