Malicious Code Injection in evalstream Package - PyPI Vulnerability
Summary
MAL-2026-18161: Malicious code in evalstream (PyPI). Affects evalstream versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The evalstream package, available on PyPI, is designed to execute code from a specified URL. It is part of a coordinated campaign that has been identified as potentially harmful, as it allows for the execution of remote scripts, which can lead to severe security issues. The package's functionality, while seemingly benign, poses significant risks due to its ability to download and execute arbitrary code.
Vulnerability Detail
The vulnerability in the evalstream package originates from its design, which permits the execution of code fetched from a remote URL. This feature can be exploited by malicious actors to inject harmful scripts, leading to unauthorized access, data theft, or system compromise. The campaign associated with this vulnerability has been identified as having malicious intent, specifically targeting users with infostealers and other harmful payloads.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall evalstreamIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the evalstream package until a secure version is released. If you must use it, consider implementing strict network controls to limit the execution of remote scripts.
Conclusion
The evalstream package presents a significant security risk due to its ability to execute remote code. Users are advised to update to the latest version or refrain from using the package until a secure alternative is available. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for evalstream →
FAQ
evalstream is a Python package that allows users to execute code from a specified URL, which can pose security risks if misused.
The vulnerability allows malicious code to be executed on your system, potentially leading to data breaches or unauthorized access.
Check the official PyPI repository for the evalstream package for any updates or patches that address this vulnerability.
Immediately update the package to the latest version or consider removing it from your project until a secure version is available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground without any signup.
