Malicious Code Vulnerability in gcpipwrap Package - Exfiltration of Sensitive Data
Summary
MAL-2026-2113: Malicious code in gcpipwrap (PyPI). Affects gcpipwrap versions 0.1.2 – 0.1.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gcpipwrap package, available on PyPI, is designed to facilitate interactions with Google Cloud Platform services. It serves as a wrapper to streamline API calls and manage authentication. However, it has been identified as part of a malicious campaign that exploits its dependencies to perform harmful actions, including data exfiltration.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the gcpipwrap package and its dependencies. This code is designed to exfiltrate sensitive information, such as the user's IP address and username, through DNS requests. The malicious actions are orchestrated by leveraging dependencies that are not harmful on their own but work in conjunction to achieve the malicious intent. The campaign associated with this vulnerability is identified as 2026-03-geekennedy.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall gcpipwrapIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the gcpipwrap package until a secure version is confirmed. Additionally, consider monitoring your application for any suspicious activity related to the domains associated with this vulnerability, such as '1r.vc' and 'gcloudns.net'.
Conclusion
The gcpipwrap package has been identified as having a serious vulnerability that allows for the exfiltration of sensitive data. It is crucial for users of this package to update to the latest version to protect their applications from potential threats. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for gcpipwrap →
FAQ
gcpipwrap is a Python package that acts as a wrapper for Google Cloud Platform services, simplifying API interactions.
The vulnerability can lead to unauthorized data exfiltration, potentially compromising sensitive user information.
You should immediately update to the latest patched version of gcpipwrap to mitigate the risk of data exfiltration.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using your Pipfile.lock. You can also check your application against known vulnerabilities using the Vulert playground.
Yes, the domains '1r.vc' and 'gcloudns.net' are known to be associated with malicious activities linked to this vulnerability.
