Malicious Code Detected in indpack: A Threat to PyPI Users
Summary
MAL-2026-2114: Malicious code in indpack (PyPI). Affects indpack versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
indpack is a package available on the Python Package Index (PyPI) that serves as a build dependency for various Python projects. It is designed to facilitate the installation and management of Python packages. However, recent investigations have revealed that indpack is associated with a malicious campaign that exploits its functionality to execute harmful actions on users' systems.
Vulnerability Detail
The vulnerability in indpack stems from its inclusion in a malicious campaign identified as 2026-03-geekennedy. The package is not inherently malicious but is used in conjunction with other dependencies to exfiltrate sensitive information, such as IP addresses and usernames, through DNS queries. The malicious code is embedded within the package, making it a vector for infostealers and other harmful activities. The risk level is considered limited, but the potential for data compromise is significant.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall indpackIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the indpack package until a definitive fix is confirmed. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The indpack package has been identified as part of a malicious campaign that poses a risk to users by exfiltrating sensitive information. It is crucial for developers and users to stay informed about such vulnerabilities and take proactive measures to secure their applications.
See every vulnerability recorded for indpack →
FAQ
The vulnerability involves malicious code that can exfiltrate sensitive information from the user's system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you are using indpack, it is recommended to update to the latest version or consider alternative packages until the issue is resolved.
The vulnerability was reported by Kamil Mańkowski (kam193), who has provided detailed insights into the malicious activities associated with indpack.
The potential consequences include unauthorized access to sensitive information, which could lead to data breaches and privacy violations.
