Malicious Code Exfiltration in hexdeci Package on PyPI
Summary
MAL-2025-192367: Malicious code in hexdeci (PyPI). Affects hexdeci versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The hexdeci package, available on the Python Package Index (PyPI), is suspected to be designed for private key exfiltration. It appears to be related to cryptocurrency, specifically TRX (Tron/Tronix). The package has been observed to clone the README files of legitimate libraries, raising concerns about its authenticity and potential malicious intent.
Vulnerability Detail
The hexdeci package contains malicious code aimed at exfiltrating sensitive information, particularly private keys. This vulnerability originates from a campaign identified as '2025-04-tronix', which is characterized by the deployment of packages with clear malicious intent, such as infostealers. The package has been linked to various domains that may facilitate data exfiltration, making it a significant security risk for users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall hexdeciIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the hexdeci package altogether. If you need similar functionality, consider using well-established and trusted libraries that do not have known vulnerabilities.
Conclusion
The hexdeci package poses a significant security risk due to its malicious intent aimed at private key exfiltration. Users are strongly advised to uninstall the package and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for hexdeci →
FAQ
The hexdeci package is a Python library that appears to be related to cryptocurrency and is suspected of being designed for malicious purposes, specifically private key exfiltration.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without any signup.
If you have installed the hexdeci package, you should uninstall it immediately using the command 'pip uninstall hexdeci' to mitigate the risk of data exfiltration.
Yes, several domains have been identified that may be associated with the hexdeci package, including mockapi.io and ngrok-free.dev, which could be used for data exfiltration.
Currently, there are no patched versions of the hexdeci package available. It is advised to avoid using this package altogether.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
