Critical Malicious Code Vulnerability in cicibot-fix-message-naming Package
Summary
MAL-2026-921: Malicious code in cicibot-fix-message-naming (PyPI). Affects cicibot-fix-message-naming versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The cicibot-fix-message-naming package is a Python library available on PyPI, designed to assist with message naming conventions in CI/CD workflows. However, it has been identified to contain malicious code that poses a significant security risk to users. This vulnerability allows attackers to execute arbitrary commands on the victim's machine through a reverse shell.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the cicibot-fix-message-naming package. When the module is imported, it initiates a reverse shell connection to an external IP address (52.77.142.175), allowing attackers to gain unauthorized access and control over the victim's system. This poses severe risks, including data theft, system compromise, and further exploitation of the affected machine.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cicibot-fix-message-namingIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid importing the cicibot-fix-message-naming package until a safe version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The cicibot-fix-message-naming package contains a critical vulnerability that allows for malicious code execution via a reverse shell. Users are advised to uninstall the package and monitor for updates or alternatives to ensure their systems remain secure.
See every vulnerability recorded for cicibot-fix-message-naming →
FAQ
It is a Python library designed to assist with message naming conventions in CI/CD workflows.
It allows attackers to execute arbitrary commands on the victim's machine through a reverse shell.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without requiring access to the code or installation.
You should uninstall the package immediately and refrain from using it until a safe version is released.
Yes, consider using other packages that provide similar functionality without the associated security risks.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
