Malicious Code Injection in graphnode Package - PyPI Vulnerability
Summary
MAL-2025-192376: Malicious code in graphnode (PyPI). Affects graphnode versions 1.0.0 – 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The graphnode package, available on PyPI, is intended for use in graph-related applications, leveraging the functionalities of the networkx library. However, a malicious version of this package has been identified, which poses significant security risks to users by embedding harmful scripts that can execute unauthorized actions on the user's system.
Vulnerability Detail
The vulnerability originates from a malicious copy of the graphnode package, which is actually a disguised version of the networkx package. This malicious version contains an obfuscated script designed to download and execute further harmful scripts from various remote locations. The obfuscation technique used makes it difficult to detect the malicious intent, and the script attempts to erase all traces of its presence after execution. The ultimate goal of this malicious activity remains unclear, but it poses serious risks such as data theft or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall graphnodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the graphnode package until a verified safe version is released. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The graphnode package has been compromised by a malicious actor, embedding harmful scripts that can jeopardize user systems. It is crucial for users to uninstall the affected package and monitor their systems for any unusual activity. Utilizing tools like Vulert can aid in real-time vulnerability monitoring.
See every vulnerability recorded for graphnode →
FAQ
The graphnode package is a Python library intended for graph-related applications, leveraging functionalities from the networkx library.
You can check the installed version of the graphnode package using 'pip show graphnode' and compare it against known safe versions.
Uninstall the malicious version immediately using 'pip uninstall graphnode' and install a verified safe version.
The malicious code obfuscates its actions, downloads additional harmful scripts from remote locations, and attempts to erase its traces after execution.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code or installation. You can check if your application is affected using the Vulert playground.
