Malicious Code Detected in cleanup-string Package: A Critical Vulnerability
Summary
MAL-2026-17325: Malicious code in cleanup-string (PyPI). Affects cleanup-string versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cleanup-string package is a pure-Python string helper designed for operations such as stripping, slugifying, case conversion, and whitespace collapse. It claims to utilize only standard library components, making it appealing for developers seeking lightweight string manipulation tools. However, it has been found to include a Windows-only native extension that raises significant security concerns.
Vulnerability Detail
The vulnerability originates from the inclusion of a malicious Windows-only native extension, _impl.cp313-win_amd64.vmp.pyd, which is loaded by the package. This extension is obfuscated using VMProtect, a tool designed to prevent static and dynamic analysis, making it difficult to ascertain its true functionality. The presence of this opaque code means that any Python environment importing cleanup-string executes potentially harmful operations with the privileges of the importing process, posing a serious security risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cleanup-stringIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the cleanup-string package altogether and consider alternative libraries for string manipulation that do not include native extensions or have known vulnerabilities.
Conclusion
The cleanup-string package has been identified as containing malicious code that poses a significant security risk to users. It is crucial to remove this package from any projects and to monitor for updates or patches that may address this vulnerability. Utilizing tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for cleanup-string →
FAQ
The malicious code is embedded in a Windows-only native extension that is obfuscated to prevent analysis, posing a risk to any environment that imports the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Currently, the cleanup-string package has been flagged for containing malicious code. It is advisable to remove it from your environment until a safe version is released.
If you have used cleanup-string, you should remove it immediately and review your project for any potential security implications. Consider using alternative libraries.
The obfuscation makes it difficult for developers and security tools to analyze the code, increasing the risk of executing harmful operations without detection.
