Critical Malicious Code Vulnerability in donutautosellsrc Package
Summary
MAL-2026-17192: Malicious code in donutautosellsrc (PyPI). Affects donutautosellsrc versions 0.3.7 – 0.3.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The donutautosellsrc package, available on PyPI, is designed for automating the selling of cryptocurrency assets. It is intended to simplify trading strategies for users. However, this package has been found to contain malicious code that compromises user security, making it susceptible to data theft and unauthorized access.
Vulnerability Detail
The vulnerability originates from the package's installation process, which fetches hidden code embedded in an image. This image contains a Python application with a native extension module that is obfuscated. The native module acts as an infostealer, collecting sensitive user data and exfiltrating it to a command-and-control (C2) server identified through transaction history on the Polygon blockchain. The malicious behavior includes downloading and executing remote executables, utilizing steganography, and employing obfuscation techniques to hide its true intent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall donutautosellsrcIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the donutautosellsrc package until a secure version is released. Additionally, users should monitor their systems for any unauthorized data access and consider using network security tools to detect and block suspicious activities.
Conclusion
The donutautosellsrc package has been identified as containing malicious code that poses a significant risk to users by stealing sensitive information. Immediate action is required to mitigate this vulnerability by uninstalling the affected versions and monitoring for any suspicious activity. Users are encouraged to stay informed about updates and security patches.
See every vulnerability recorded for donutautosellsrc →
FAQ
The donutautosellsrc package is a Python library designed for automating cryptocurrency trading strategies.
The vulnerability allows malicious code to collect sensitive data from users and send it to a remote server, potentially leading to identity theft and financial loss.
Uninstall the affected versions of donutautosellsrc immediately and upgrade to a secure version if available.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using your Pipfile.lock. You can also check your application against known vulnerabilities using the Vulert playground.
Detailed information can be found in the vulnerability report on the official GitHub repository or through security advisories related to the donutautosellsrc package.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
