Malicious Code Exfiltration in f5rest Package
Summary
MAL-2025-192609: Malicious code in f5rest (PyPI). Affects f5rest versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The f5rest package, available on PyPI, is designed for interacting with F5 REST APIs. It is intended to facilitate network management and automation tasks. However, this package has been identified as malicious, containing code that exfiltrates sensitive information from the host system during installation, posing a significant security risk to users.
Vulnerability Detail
The vulnerability originates from the f5rest package, which includes malicious code that executes upon installation. This code is designed to exfiltrate basic information about the host, such as the IP address and username, without the user's consent. The package overrides the install command in setup.py, ensuring that the malicious code runs automatically, making it a serious threat to system security and privacy.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall f5restIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds to mitigate the effects of this malicious package. The best course of action is to uninstall the package and refrain from using it. If you need similar functionality, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The f5rest package has been identified as malicious, containing code that exfiltrates sensitive information from the host system. Users are advised to uninstall the package immediately and avoid using it in the future. Monitoring tools like Vulert can help keep your software secure by alerting you to vulnerabilities.
See every vulnerability recorded for f5rest →
FAQ
The f5rest package is intended for interacting with F5 REST APIs for network management and automation tasks.
The malicious code exfiltrates basic information from the host system, such as the IP address and username, during the installation process.
You should uninstall the f5rest package immediately using the command pip uninstall f5rest.
No, there is currently no patched version of the f5rest package available. It is recommended to avoid this package entirely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
