Malicious Code Exfiltration in crypo Package
Summary
MAL-2025-192947: Malicious code in crypo (PyPI). Affects crypo versions 0.0.1 – 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The crypo package, available on PyPI, is intended for cryptographic operations. However, it has been identified as a malicious package that serves no legitimate purpose other than to exfiltrate sensitive information from the host system. This includes basic data such as the user's IP address and username, posing a potential risk to user privacy and security.
Vulnerability Detail
The vulnerability originates from the package's design, which overrides the install command in setup.py to execute malicious code during installation. This code is responsible for exfiltrating basic information about the host system. The risk is categorized as limited, but it still poses a threat as it can compromise user data without their consent. The malicious behavior is embedded in the package, making it difficult for users to detect without thorough scrutiny.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall crypoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should avoid installing the crypo package altogether. If it has already been installed, ensure to remove it using the command: 'pip uninstall crypo'. Regularly audit your installed packages and dependencies to prevent similar issues.
Conclusion
The crypo package has been identified as a malicious package that exfiltrates sensitive information from users' systems. It is crucial for users to uninstall this package and remain vigilant about the packages they install. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for crypo →
FAQ
The crypo package is a Python package available on PyPI, primarily intended for cryptographic operations, but it has been identified as malicious.
The crypo package exfiltrates basic information such as the user's IP address and username from the host system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed the crypo package, you should uninstall it immediately using the command 'pip uninstall crypo'.
To prevent similar vulnerabilities, regularly audit your dependencies, use trusted sources for packages, and consider using tools like Vulert for real-time monitoring of vulnerabilities.
