Malicious Code Exfiltration in groq-ppe-pkg: A Security Risk
Summary
MAL-2026-913: Malicious code in groq-ppe-pkg (PyPI). Affects groq-ppe-pkg versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'groq-ppe-pkg' package, available on PyPI, is designed for Python developers. However, it has been identified as a malicious package that serves no legitimate purpose other than to exfiltrate basic information from the host system, such as IP addresses and usernames. This vulnerability poses a significant risk to users who inadvertently install the package.
Vulnerability Detail
The vulnerability originates from the package's design, which overrides the install command in the setup.py file to execute malicious code during installation. This code is responsible for exfiltrating sensitive data from the user's system. The package has been categorized under PROBABLY_PENTEST, indicating that it resembles typical penetration testing tools but carries the risk of unauthorized data access. The malicious code is executed without the user's consent, leading to potential privacy breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall groq-ppe-pkgIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds for this vulnerability other than avoiding the installation of the 'groq-ppe-pkg' package. If you have already installed it, ensure to uninstall it as mentioned above.
Conclusion
The groq-ppe-pkg package poses a significant security risk due to its malicious code that exfiltrates sensitive information from users' systems. Immediate uninstallation is necessary to mitigate this risk, as there is no patched version available. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for groq-ppe-pkg →
FAQ
groq-ppe-pkg is a Python package available on PyPI that has been identified as malicious, designed to exfiltrate sensitive information from the host system.
The malicious code overrides the installation command in setup.py, executing unauthorized actions that collect and send basic information like IP addresses and usernames.
If you have installed groq-ppe-pkg, you should uninstall it immediately using the command 'pip uninstall groq-ppe-pkg'.
Currently, there is no safe or patched version of groq-ppe-pkg available. The best course of action is to uninstall it.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
