Malicious Code Detected in hidden-powershell-runner-ax7: Remote Executable Download Vulnerability
Summary
MAL-2025-192659: Malicious code in hidden-powershell-runner-ax7 (PyPI). Affects hidden-powershell-runner-ax7 versions 0.1.0 – 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package hidden-powershell-runner-ax7 is a Python library available on PyPI that is intended for running PowerShell scripts. However, it has been compromised to include malicious code that downloads and executes a remote executable, posing significant security risks to users. This vulnerability can lead to unauthorized access, data theft, and system compromise.
Vulnerability Detail
The vulnerability originates from a malicious actor who has modified the hidden-powershell-runner-ax7 package to include code that downloads a remote executable identified as malware. This malicious code is executed upon importing the module, allowing the attacker to potentially control the victim's system. The campaign associated with this vulnerability is labeled '2025-12-foxloveyou', which indicates its malicious intent, specifically targeting users with infostealers and other forms of malware.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall hidden-powershell-runner-ax7If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the hidden-powershell-runner-ax7 package. If you require similar functionality, consider using alternative packages that do not have known vulnerabilities. Always verify the integrity and source of any package before installation.
Conclusion
The hidden-powershell-runner-ax7 package has been compromised to include malicious code that poses serious security risks. Users are advised to uninstall the package immediately and seek alternatives. Regular monitoring of your dependencies is essential to maintain security.
See every vulnerability recorded for hidden-powershell-runner-ax7 →
FAQ
hidden-powershell-runner-ax7 is a Python package designed to facilitate the execution of PowerShell scripts.
The vulnerability allows malicious code to be executed on your system, which can lead to unauthorized access and data theft.
You should immediately uninstall the package using pip uninstall hidden-powershell-runner-ax7 and avoid using it until a secure version is released.
Yes, consider using other packages that provide similar functionality without known vulnerabilities. Always check the package's reputation and reviews.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against vulnerabilities using the Vulert playground without any signup.
