Malicious Code Detected in chrome-stealth Package: Proxy Network Exploitation
Summary
MAL-2026-28: Malicious code in chrome-stealth (PyPI). Affects chrome-stealth versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chrome-stealth package, available on PyPI, is designed to facilitate web scraping by evading detection mechanisms. However, it has been found to contain malicious code that connects users' computers to a proxy network, sharing their IP and bandwidth without consent. This functionality raises significant privacy and security concerns, as the proxy network appears to be operated by a dubious entity.
Vulnerability Detail
The vulnerability originates from the package's design, which primarily serves to connect users to a proxy network. This connection is made without the user's explicit consent, effectively modifying the system's behavior. The proxy network is suspicious, with a newly registered domain and a lack of transparency regarding its operations. Users are left vulnerable to potential misuse of their bandwidth and IP address, which could lead to further exploitation or legal issues.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall chrome-stealthIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using the chrome-stealth package altogether and seek alternative libraries for web scraping that do not have known vulnerabilities. Additionally, users can monitor their network traffic for any unusual activity that may indicate unauthorized use of their IP address.
Conclusion
The chrome-stealth package has been identified as containing malicious code that compromises user privacy and security by connecting systems to a proxy network without consent. Users are advised to uninstall the package and consider safer alternatives for their web scraping needs.
See every vulnerability recorded for chrome-stealth →
FAQ
chrome-stealth is a Python package designed to help users scrape web content while avoiding detection by anti-bot mechanisms.
The vulnerability connects your computer to a proxy network without your consent, potentially exposing your IP address and bandwidth to malicious actors.
You should uninstall the chrome-stealth package immediately to prevent any unauthorized use of your system.
Yes, consider using other web scraping libraries such as Beautiful Soup or Scrapy, which do not have known vulnerabilities.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
