Malicious Code Detected in connections-api-requests Package - Remote Executable Execution Vulnerability
Summary
MAL-2026-641: Malicious code in connections-api-requests (PyPI). Affects connections-api-requests versions 0.1.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The connections-api-requests package is a Python library available on PyPI that facilitates API interactions. It is designed to streamline connections and requests to various APIs, making it a useful tool for developers. However, this package has been compromised, leading to a significant security vulnerability that allows for the execution of malicious code.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2025-12-foxloveyou', where the package imports a module that downloads and executes a remote executable identified as malware. This poses severe risks, including unauthorized access to sensitive data, system compromise, and potential data breaches. The malicious code is embedded in version 0.1.9 of the package, making it imperative for users to be aware of the risks associated with this version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall connections-api-requestsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the connections-api-requests package until a secure version is confirmed. Additionally, consider implementing network security measures to block any connections to the identified malicious domains (e.g., 3zoz.duckdns.org) to prevent potential exploitation.
Conclusion
The connections-api-requests package has been compromised, leading to a serious vulnerability that can execute malicious code. Users must take immediate action to update or remove the package to mitigate risks. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for connections-api-requests →
FAQ
It is a Python library designed to facilitate API interactions, allowing developers to easily connect and make requests to various APIs.
The vulnerability involves malicious code that downloads and executes a remote executable, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Immediately update the package to a secure version using 'pip install --upgrade connections-api-requests' or avoid using the package until a patch is confirmed.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock, providing a streamlined way to manage security.
