Malicious Code Vulnerability in facewareretargeter Package
Summary
MAL-2026-18110: Malicious code in facewareretargeter (PyPI). Affects facewareretargeter versions 9.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The facewareretargeter package, available on PyPI, is designed for specific functionalities related to tracking downloads. However, it has been identified as a malicious package that utilizes fake HTTP-downloaded dependencies solely for the purpose of tracking, raising significant security concerns for users who may unknowingly integrate it into their projects.
Vulnerability Detail
The vulnerability stems from the package's use of deceptive dependencies that track downloads without any legitimate purpose. This malicious behavior can lead to data leakage and unauthorized tracking of user activities. The package is categorized under PROBABLY_PENTEST, indicating that it resembles typical penetration testing tools but poses low-harm possibilities. The origin of this vulnerability is linked to a campaign identified as 2026-10-vacsdk, which highlights the risks associated with dependency confusion.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall facewareretargeterIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider using alternative packages that provide similar functionality without the associated risks. It is advisable to review the dependencies of any package before installation to ensure they are legitimate and secure.
Conclusion
The facewareretargeter package has been identified as a malicious package that poses significant security risks due to its deceptive tracking mechanisms. Users are advised to remove this package and consider alternatives while monitoring their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for facewareretargeter →
FAQ
The facewareretargeter package is a Python package available on PyPI that is intended for tracking downloads but has been identified as malicious.
The vulnerability can lead to unauthorized tracking of user activities and potential data leakage, compromising the security of your application.
If you have installed the facewareretargeter package, it is recommended to uninstall it immediately using the command: pip uninstall facewareretargeter.
Yes, consider using other reputable packages that provide similar functionalities without the associated risks. Always verify the legitimacy of dependencies.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
