Malicious Code Exploit in donutpromotion Package: Infostealer Threat
Summary
MAL-2026-17196: Malicious code in donutpromotion (PyPI). Affects donutpromotion versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The donutpromotion package, available on PyPI, is designed for promotional purposes within Python applications. However, it has been compromised to include malicious code that poses significant security risks. This package utilizes obfuscated code to execute hidden functionalities, making it susceptible to exploitation by attackers.
Vulnerability Detail
The vulnerability originates from an obfuscated code segment within the donutpromotion package, which fetches malicious code hidden in an image. This code contains a native extension module that acts as an infostealer, collecting sensitive user data and exfiltrating it to a command and control (C2) server identified through transaction history on the Polygon blockchain. The package also includes mechanisms to detect sandbox environments, further complicating detection efforts.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall donutpromotionIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the donutpromotion package from your environment until a secure version is released. You can uninstall it using the command: 'pip uninstall donutpromotion'. Additionally, monitor your system for any unusual activity that may indicate data exfiltration.
Conclusion
The donutpromotion package has been identified as containing malicious code that poses a serious security threat. Users are advised to uninstall the package and monitor their systems closely. Keeping software updated and utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities.
See every vulnerability recorded for donutpromotion →
FAQ
The donutpromotion package is a Python library intended for promotional activities within applications, but it has been compromised to include malicious code.
The vulnerability allows an infostealer to collect sensitive data from your system and send it to a remote server, potentially leading to data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If you have installed donutpromotion, it is recommended to uninstall it immediately and monitor your system for any suspicious activity.
Yes, indicators include unusual network traffic to unknown domains, such as 'thisisafalsepositive.st' and 'sltnnt.ru', as well as unexpected data exfiltration.
