Malicious Code Injection in FastPI Package - Security Alert
Summary
MAL-2026-613: Malicious code in fastpi (PyPI). Affects fastpi versions 0.128.0 – 0.128.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FastPI is a popular web framework for building APIs with Python, known for its speed and ease of use. It allows developers to create robust applications quickly. However, a malicious version of FastPI has been identified, which poses significant security risks to users who may inadvertently install it.
Vulnerability Detail
The vulnerability originates from a malicious copy of the legitimate FastAPI package, uploaded by a user named kam193. This compromised version includes encrypted and obfuscated code that is likely designed to perform harmful actions, such as data theft or unauthorized access. The exact behavior of the malicious code remains unknown, but its obfuscation and the method of delivery raise serious concerns about the integrity of the software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall fastpiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the FastPI package and ensure that your application dependencies are sourced from trusted repositories. Regularly check for updates and security advisories related to your dependencies.
Conclusion
The discovery of a malicious version of the FastPI package highlights the importance of vigilance when managing software dependencies. Users are urged to uninstall the compromised package and switch to the legitimate FastAPI to ensure their applications remain secure.
See every vulnerability recorded for fastpi →
FAQ
FastPI is a Python web framework designed for building APIs quickly and efficiently, leveraging modern Python features.
Check your installed packages using 'pip list' and verify the package name. If you see 'fastpi', you may have the malicious version.
Immediately uninstall the package using 'pip uninstall fastpi' and install the legitimate FastAPI package with 'pip install fastapi'.
Always verify package sources and consider using tools like Vulert to monitor your dependencies for vulnerabilities.
Vulert is a service that monitors open-source vulnerabilities in your software using just the Pipfile.lock. You can check your application for vulnerabilities in real-time without any installation.
