Malicious Code in clawdest Package: A Security Threat
Summary
MAL-2026-897: Malicious code in clawdest (PyPI). Affects clawdest versions 1.1.2 – 1.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The clawdest package, available on PyPI, is designed for Python developers to facilitate certain functionalities. However, it has been identified as a malicious package that poses significant security risks to users. The package is capable of downloading and executing remote executables, which can lead to unauthorized access and potential data breaches.
Vulnerability Detail
The vulnerability originates from the clawdest package, which contains hardcoded instructions to download a malicious executable and save it in the user's local application data directory. This behavior is indicative of a malicious intent to hide the executable under a generic name. Although the analyzed versions did not trigger the execution of the downloaded file, the package is prepared to alter security settings and run the executable with elevated privileges. The package also attempts to execute scripts on non-Windows systems, indicating a broader scope of potential exploitation. The campaign associated with this vulnerability has been categorized as malicious due to its capability to download and execute remote files, posing a significant risk to users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall clawdestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid executing any commands associated with the clawdest package until it has been completely removed from their systems. Additionally, consider using a virtual environment to isolate your projects and minimize the risk of exposure to malicious packages.
Conclusion
The clawdest package presents a significant security threat due to its malicious capabilities to download and execute remote files. Users are strongly advised to uninstall the package immediately and monitor their systems for any unusual activity. Utilizing tools like Vulert can help in identifying and managing vulnerabilities in open-source software.
See every vulnerability recorded for clawdest →
FAQ
The clawdest package is a Python package available on PyPI, intended for developers but has been identified as malicious.
The vulnerability allows the package to download and execute malicious executables, potentially compromising your system's security.
You should uninstall the clawdest package immediately using the command: pip uninstall clawdest.
No, there are no patches available for clawdest as it has been identified as a malicious package. The best course of action is to uninstall it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground without needing to sign up.
