Critical Malicious Code Vulnerability in coinscan Package
Summary
MAL-2026-17197: Malicious code in coinscan (PyPI). Affects coinscan versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The coinscan package, available on PyPI, is designed for cryptocurrency-related functionalities. However, it has been compromised with malicious code that executes arbitrary commands on the user's machine. This vulnerability poses a significant risk to developers and users who install the package, as it can lead to data theft and unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability originates from the installation process of the coinscan package, which imports and executes malicious code from an external source. Specifically, during installation, the setup.py file calls a function that fetches a JSON manifest from a suspicious domain. If the fetch fails, it falls back to an embedded payload that executes arbitrary code. The malicious code is designed to evade detection by checking for specific environment variables, ensuring it only runs on developer workstations and not in CI or sandbox environments. This behavior exemplifies a classic dropper pattern, making it a severe security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall coinscanIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the coinscan package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The coinscan package contains a critical vulnerability that allows for the execution of malicious code, posing significant risks to users. Immediate action is required to uninstall the package and monitor for updates. Utilizing tools like Vulert can help ensure your applications remain secure against such vulnerabilities.
See every vulnerability recorded for coinscan →
FAQ
The coinscan package is a Python library used for cryptocurrency-related functionalities, but it has been compromised with malicious code.
The vulnerability manifests during the installation process, where malicious code is executed from an external source or an embedded payload.
The risks include unauthorized access to sensitive data, potential data theft, and the execution of arbitrary commands on the user's machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring a signup.
If you have installed the coinscan package, uninstall it immediately and check for any updates or patches from the official repository.
