Malicious Code Vulnerability in haqawi Package: Remote Script Execution
Summary
MAL-2026-255: Malicious code in haqawi (PyPI). Affects haqawi versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The haqawi package, available on PyPI, is designed to facilitate certain functionalities in Python applications. However, it has been identified as a malicious package that downloads and executes remote scripts, posing significant security risks to users. This vulnerability allows attackers to execute arbitrary code on the victim's machine, leading to potential data breaches and system compromises.
Vulnerability Detail
The haqawi package contains malicious code that is engineered to download and execute a remote script. This script subsequently downloads and runs a malicious executable, which can lead to severe consequences such as data theft and unauthorized access to the system. The vulnerability originates from the package's design, which allows it to fetch and execute code from untrusted sources, making it a prime target for exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall haqawiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than uninstalling the haqawi package. Users can do this by executing the following command in their terminal: 'pip uninstall haqawi'.
Conclusion
The haqawi package poses a significant security risk due to its malicious code that executes remote scripts. Users are strongly advised to uninstall the package immediately to prevent potential exploitation. Continuous monitoring for vulnerabilities is essential to maintain application security.
See every vulnerability recorded for haqawi →
FAQ
The haqawi package is a Python library available on PyPI, designed for specific functionalities but has been identified as malicious.
The vulnerability allows malicious code to be executed on your system, potentially leading to data theft and unauthorized access.
You should uninstall the haqawi package immediately using 'pip uninstall haqawi' to protect your system.
Currently, there is no patched version available for the haqawi package. The best course of action is to uninstall it.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock. You can also check your application against known vulnerabilities using the Vulert playground without any signup.
