Malicious Code Vulnerability in dell-restore-system Package
Summary
MAL-2025-192306: Malicious code in dell-restore-system (PyPI). Affects dell-restore-system versions 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dell-restore-system package, available on PyPI, is designed for system restoration tasks. However, it has been identified as containing malicious code that exfiltrates sensitive information from the host system. This vulnerability poses a risk to users who install or import the package, as it can compromise their data security.
Vulnerability Detail
The vulnerability originates from the package's code, which is designed to exfiltrate basic information such as the host's IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious code, making it a significant security threat. Users who install this package unknowingly expose their system information to potential attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall dell-restore-systemIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should avoid installing the dell-restore-system package altogether. If it is already installed, it should be uninstalled using the command: 'pip uninstall dell-restore-system'. Additionally, consider using tools like Vulert to monitor for vulnerabilities in your dependencies.
Conclusion
The dell-restore-system package contains a serious vulnerability that allows for the exfiltration of sensitive information from the host system. Users are advised to uninstall the package immediately and monitor their dependencies for vulnerabilities using tools like Vulert.
See every vulnerability recorded for dell-restore-system →
FAQ
The dell-restore-system package is a tool available on PyPI intended for system restoration tasks, but it has been compromised with malicious code.
The malicious code exfiltrates basic information such as the host's IP address and username.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed the dell-restore-system package, you should uninstall it immediately using the command: 'pip uninstall dell-restore-system'.
To prevent similar vulnerabilities, always verify the source of packages before installation and use tools like Vulert to monitor your dependencies for known vulnerabilities.
