Malicious Code Detected in ighack: A Threat to User Credentials
Summary
MAL-2026-1410: Malicious code in ighack (PyPI). Affects ighack versions 3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ighack is a Python package available on PyPI, designed as an Instagram hacking tool. It utilizes the Instagram API to perform various actions, including following accounts. However, it has been identified to misuse user credentials for following hardcoded accounts, posing a significant security risk to users.
Vulnerability Detail
The vulnerability stems from the malicious intent of the package, which not only abuses the Instagram API but also exfiltrates user credentials without consent. This behavior can lead to unauthorized actions on behalf of the user, including following accounts that the user did not intend to follow. The package is associated with a campaign identified as '2026-03-old-nai', and its malicious code was traced back to a specific commit by the source 'kam193'.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ighackIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should avoid using the ighack package and refrain from entering their Instagram credentials into any untrusted applications. Instead, consider using official Instagram tools and APIs that comply with security standards.
Conclusion
The ighack package has been identified as malicious, with the potential to misuse user credentials and perform unauthorized actions on Instagram. Users are advised to uninstall the package and monitor their accounts for any suspicious activity. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities in the future.
See every vulnerability recorded for ighack →
FAQ
The main risk is that it exfiltrates user credentials and performs unauthorized actions on Instagram accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
You should uninstall the package immediately using 'pip uninstall ighack' to prevent any unauthorized actions.
Yes, consider using official Instagram APIs and tools that adhere to security best practices.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock, ensuring your software remains secure.
