Malicious Code Exploit in isb Package: Infostealer and RAT Functionality
Summary
MAL-2026-1090: Malicious code in isb (PyPI). Affects isb versions 1.0.0 – 1.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'isb' package, available on PyPI, is designed for various functionalities within Python applications. However, it has been compromised, embedding malicious code that initiates an infostealer with capabilities similar to Remote Access Trojans (RATs). This vulnerability allows unauthorized access to sensitive information and system configurations.
Vulnerability Detail
The vulnerability originates from a malicious actor identified as 'kam193', who has embedded code that activates an infostealer upon module initiation. This code is capable of exfiltrating browser data, collecting credentials, taking screenshots, recording audio, and modifying system settings. It also ensures persistence by adding itself to the system's autostart, making it a significant threat to user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall isbIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the 'isb' package until it has been confirmed safe. You can also monitor your system for any unauthorized activities and consider using security software to detect and remove potential threats.
Conclusion
The 'isb' package has been compromised with malicious code that poses significant risks to user security and privacy. It is essential to update the package to a secure version and monitor your systems for any unauthorized activities. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for isb →
FAQ
The 'isb' package is a Python library available on PyPI, intended for various functionalities in Python applications.
The vulnerability allows for infostealing, exfiltration of browser data and credentials, taking screenshots, and modifying system configurations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed the 'isb' package, immediately uninstall it and update to a patched version if available. Use 'pip uninstall isb' followed by 'pip install --upgrade isb' to ensure you have the latest secure version.
The vulnerability was reported by Kamil Mańkowski, known as 'kam193', who is also the source of the malicious code.
