Critical Malicious Code Vulnerability in cryptozip Package
Summary
MAL-2025-192956: Malicious code in cryptozip (PyPI). Affects cryptozip versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptozip package, available on PyPI, is designed for handling ZIP archives in Python applications. It offers functionalities for creating, reading, and manipulating ZIP files. However, a recent vulnerability has been identified that allows malicious code execution during the initialization of the archive-support class, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious code injection in the cryptozip package, specifically in version 0.1.0. Upon initialization, the package executes code from an external file, which downloads multi-stage malware. This behavior is indicative of a malicious campaign aimed at executing remote executables, leading to potential data breaches and system compromises. The obfuscation techniques used further complicate detection and mitigation efforts.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall cryptozipIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the cryptozip package and look for alternative libraries that provide similar functionalities without the associated risks. Additionally, ensure that your environment is secured and monitor for any suspicious activities.
Conclusion
The cryptozip package has a critical vulnerability that allows for malicious code execution, posing significant risks to users. Immediate action is required to update or remove the package to safeguard against potential threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for cryptozip →
FAQ
The vulnerability involves malicious code execution that downloads and executes malware during the package's initialization process.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update the package, it is recommended to remove it from your project and seek alternative libraries until a secure version is released.
The consequences include unauthorized access to sensitive data, system compromises, and the potential for further malware distribution.
The vulnerability was reported by Kamil Mańkowski, who can be contacted through their GitHub profile.
