Malicious Code Exfiltration in hash-utils-py Package
Summary
MAL-2026-2118: Malicious code in hash-utils-py (PyPI). Affects hash-utils-py versions 1.0.0 – 1.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hash-utils-py is a Python package available on PyPI designed for various hashing utilities. It is intended to provide developers with easy-to-use functions for hashing data securely. However, a recent vulnerability has been discovered that allows malicious code to exfiltrate sensitive information from users' systems during the import of the module.
Vulnerability Detail
The vulnerability originates from a malicious actor who has embedded code within the hash-utils-py package. Upon importing the module, this code attempts to exfiltrate sensitive Telegram client session files from the user's system. This poses a significant risk as it can lead to unauthorized access to user accounts and sensitive data, making it a serious security concern for anyone using this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall hash-utils-pyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid importing the hash-utils-py package until the vulnerability has been resolved. If you must use it, consider isolating your environment to prevent potential data exfiltration.
Conclusion
The hash-utils-py package has been found to contain malicious code that can exfiltrate sensitive information from users' systems. It is essential for users to update their packages to the latest version to protect against this vulnerability. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for hash-utils-py →
FAQ
hash-utils-py is a Python package that provides hashing utilities for developers, allowing for secure data hashing.
The vulnerability allows malicious code to exfiltrate sensitive files from users' systems, potentially leading to unauthorized access to accounts.
If you have installed hash-utils-py, it is crucial to update to the latest version immediately to mitigate the risk.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using Vulert's playground without any signup.
You can find detailed information about this vulnerability in the official GitHub repository or by visiting the Vulert website.
