Malicious Code Vulnerability in chia-pool-reference Package
Summary
MAL-2026-652: Malicious code in chia-pool-reference (PyPI). Affects chia-pool-reference versions 9.0.1 – 9.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chia-pool-reference package is a Python library available on PyPI, primarily used for creating and managing Chia cryptocurrency pools. It is designed to facilitate the pooling of resources for mining Chia coins, offering features that streamline the process for users. However, this package has been identified as containing malicious code that can exfiltrate sensitive data from the user's system.
Vulnerability Detail
The vulnerability originates from obfuscated code within the chia-pool-reference package, which is designed to hide the exfiltration of basic data such as hostname, IP address, and username. This malicious behavior poses a risk to users as it can lead to unauthorized access to sensitive information. The code's obfuscation makes it difficult to detect, and it falls under the category of dependency confusion, where malicious packages mimic legitimate ones to deceive users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall chia-pool-referenceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the chia-pool-reference package until they have updated to a secure version. Additionally, monitoring network traffic for any unusual data exfiltration attempts can help mitigate risks while using the package.
Conclusion
The chia-pool-reference package has been identified as containing malicious code that can exfiltrate sensitive user data. It is crucial for users to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for chia-pool-reference →
FAQ
The chia-pool-reference package is a Python library used for managing Chia cryptocurrency pools, allowing users to pool resources for mining.
The malicious code can exfiltrate basic data such as the hostname, IP address, and username from the user's system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package immediately, consider avoiding its use and monitoring your network traffic for any suspicious activity.
You can visit Vulert at https://vulert.com, which monitors and alerts for open-source vulnerabilities in real-time using Pipfile.lock.
