Malicious Code Injection in clawdist: A Critical Vulnerability Overview
Summary
MAL-2026-909: Malicious code in clawdist (PyPI). Affects clawdist versions 1.2.5 – 1.2.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
clawdist is a Python package available on PyPI, designed for distributing and managing Python applications. It allows users to package their applications for easier deployment. However, clawdist has been found to contain malicious code that poses significant security risks, including the potential for unauthorized remote code execution.
Vulnerability Detail
The vulnerability originates from a malicious actor who has embedded code within clawdist that is designed to download and execute a hardcoded executable from a remote server. This executable is saved in the user's local application data directory under a generic name to obscure its presence. Although the code has mechanisms to alter security settings and run with elevated privileges, these were not triggered in the analyzed versions. The malicious behavior includes communication with a remote server to fetch additional payloads, which could lead to further exploitation of the system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall clawdistIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can uninstall clawdist using the command: pip uninstall clawdist. This will prevent any malicious code from executing until a secure version is confirmed.
Conclusion
The clawdist package has been identified as containing malicious code that poses serious security risks. Users are advised to update or uninstall the package immediately to protect their systems. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software effectively.
See every vulnerability recorded for clawdist →
FAQ
clawdist is a Python package used for distributing and managing Python applications, simplifying the deployment process.
The vulnerability allows malicious code to be downloaded and executed on your system, potentially leading to unauthorized access and data breaches.
You should immediately update clawdist to the latest version or uninstall it until a secure version is available.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
