Malicious Code Vulnerability in dgl-cu117 Package - Executable Decryption Risk
Summary
MAL-2026-1432: Malicious code in dgl-cu117 (PyPI). Affects dgl-cu117 versions 14.6.0 – 16.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dgl-cu117 package is a library available on PyPI, primarily used for deep learning graph neural networks. It provides functionalities that facilitate the development and training of graph-based models. However, this package has been compromised, leading to serious security concerns due to the presence of malicious code that executes upon import.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as 2026-03-ariadne-federation. During the import process, the dgl-cu117 package decrypts and executes a hidden malicious executable, which is encoded and obfuscated within a JSON resource file. This poses significant risks, including potential data theft and unauthorized access to system resources. The malicious executable is designed to operate stealthily, making detection challenging for users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall dgl-cu117If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the dgl-cu117 package until a secure version is confirmed. If you must use it, consider isolating it in a controlled environment to minimize potential damage.
Conclusion
The dgl-cu117 package has been identified as a vector for malicious code execution, posing serious security risks to users. It is essential to take immediate action by updating the package and employing monitoring tools like Vulert to safeguard against potential threats.
See every vulnerability recorded for dgl-cu117 →
FAQ
The vulnerability involves the execution of a malicious executable that is decrypted during the import of the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Immediately uninstall the package and update to a secure version using 'pip uninstall dgl-cu117' followed by 'pip install --upgrade dgl-cu117'.
Yes, the malicious code can lead to data theft, unauthorized access, and potential system compromise.
Signs may include unusual system behavior, unexpected network activity, or unauthorized access attempts. Regular monitoring is advised.
