Critical Malicious Code Vulnerability in evil-rce2 Package
Summary
MAL-2025-192362: Malicious code in evil-rce2 (PyPI). Affects evil-rce2 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The evil-rce2 package, available on PyPI, is designed for remote code execution tasks. However, it has been identified to contain malicious code that creates a reverse shell, allowing attackers to execute arbitrary commands on the victim's machine. This vulnerability poses a significant risk to users who inadvertently install this package, as it can lead to unauthorized access and control over their systems.
Vulnerability Detail
The vulnerability originates from the malicious intent embedded in the evil-rce2 package, specifically designed to establish a reverse shell upon execution. This allows an attacker to gain control over the victim's machine, execute commands, and potentially compromise sensitive data. The malicious code was reported by Kamil Mańkowski and is categorized under the 2025-12-evil-rce campaign, indicating a clear threat to users of this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall evil-rce2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds to mitigate the effects of this vulnerability. The best course of action is to ensure that the evil-rce2 package is not installed on your system. Regularly monitor your environment for any unauthorized installations.
Conclusion
The evil-rce2 package poses a serious security risk due to its malicious code that creates a reverse shell. Users are strongly advised to uninstall this package immediately and monitor their systems for any unauthorized changes. Utilizing tools like Vulert can help in identifying and managing vulnerabilities in your software.
See every vulnerability recorded for evil-rce2 →
FAQ
The evil-rce2 package is a Python package available on PyPI that is intended for remote code execution tasks but has been found to contain malicious code.
The vulnerability allows an attacker to establish a reverse shell, giving them the ability to execute commands on your machine without your consent.
You should immediately uninstall the evil-rce2 package using the command pip uninstall evil-rce2 to protect your system from potential attacks.
Currently, there is no patched version of the evil-rce2 package available. It is advised to avoid using this package entirely.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. It requires only the Pipfile.lock to operate. You can also check for vulnerabilities using the Vulert playground at Vulert Scanner without any signup.
