Malicious Code Exfiltration in heimdal-credentials Package
Summary
MAL-2026-1140: Malicious code in heimdal-credentials (PyPI). Affects heimdal-credentials versions 2.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The heimdal-credentials package, available on PyPI, is designed to manage and store credentials securely. However, it has been compromised, allowing malicious actors to exploit its functionality. This vulnerability poses a significant risk to users, as it can lead to unauthorized access to sensitive information and remote command execution.
Vulnerability Detail
The vulnerability originates from a malicious code embedded within the heimdal-credentials package, specifically in version 2.1.0. This code masquerades as telemetry during import in certain environments, exfiltrating sensitive environment variables and cloud tokens to a hardcoded location. Additionally, it initiates a job that listens for commands to execute on the victim's machine. The campaign is characterized by malicious intent, including infostealing and dependency confusion.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall heimdal-credentialsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid importing the heimdal-credentials package until a patch is confirmed. Additionally, consider using environment variable management tools that do not rely on this package.
Conclusion
The heimdal-credentials package has been compromised, leading to significant security risks including data exfiltration and remote command execution. Users must take immediate action to update the package and consider alternative solutions until a patch is confirmed.
See every vulnerability recorded for heimdal-credentials →
FAQ
The heimdal-credentials package is a Python library used for managing and storing credentials securely.
The vulnerability allows malicious code to exfiltrate sensitive information and execute commands on your machine, potentially leading to data breaches.
You should immediately update the package to the latest patched version using the command: pip install --upgrade heimdal-credentials.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the Pipfile.lock, providing real-time alerts without requiring access to the code.
