Malicious Code Exfiltration in crc32fast Package
Summary
MAL-2026-902: Malicious code in crc32fast (PyPI). Affects crc32fast versions 1.0.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The crc32fast package is a Python library available on PyPI that is designed for fast CRC32 checksum calculations. However, it has been identified as malicious due to its ability to exfiltrate sensitive information from the host system, such as IP addresses and usernames, during installation or import. This behavior undermines the trust users place in open-source packages.
Vulnerability Detail
The vulnerability in the crc32fast package arises from its malicious code that executes upon installation. This code is designed to exfiltrate basic information about the host system, including the IP address and username, to a remote server associated with malicious activities. The package overrides the install command in setup.py to execute this code, posing a risk to users who install it without awareness of its true nature.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall crc32fastIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the crc32fast package altogether. If you have already installed it, ensure to remove it immediately and monitor your system for any unusual activity.
Conclusion
The crc32fast package has been identified as malicious due to its ability to exfiltrate sensitive information from users' systems. It is crucial for users to uninstall this package and remain vigilant about the security of their installed libraries. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for crc32fast →
FAQ
crc32fast is a Python library for calculating CRC32 checksums quickly. However, it has been flagged for malicious behavior.
The vulnerability allows the package to exfiltrate sensitive information from your system, potentially compromising your privacy and security.
Uninstall the package immediately using 'pip uninstall crc32fast' and monitor your system for any suspicious activity.
As of now, there is no safe version of crc32fast. It is recommended to avoid using this package and look for alternatives.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Check your application against known vulnerabilities using the Vulert playground at Vulert Scanner.
