Malicious Code Exfiltration in kerokwis Package on PyPI
Summary
MAL-2026-16421: Malicious code in kerokwis (PyPI). Affects kerokwis versions 99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kerokwis package, available on the Python Package Index (PyPI), is designed for various functionalities related to penetration testing. However, it has been identified to contain malicious code that compromises user data. The package's primary function is overshadowed by its potential to exfiltrate sensitive information from the host system, making it a significant security risk.
Vulnerability Detail
The kerokwis package contains malicious code that exfiltrates basic information about the host, such as IP addresses and usernames, upon installation or import. This vulnerability originates from the package's setup.py file, which overrides the install command to execute harmful code during the installation process. The risk is categorized as limited but still poses a threat to user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall kerokwisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the kerokwis package altogether. If you have already installed it, you can remove it using the command: 'pip uninstall kerokwis'. Additionally, consider using alternative packages that do not pose security risks.
Conclusion
The kerokwis package has been identified as a security risk due to its malicious code that exfiltrates sensitive information from users' systems. It is crucial to uninstall this package and monitor for any updates or patches. Utilizing tools like Vulert can help keep your applications secure by alerting you to vulnerabilities in real-time.
See every vulnerability recorded for kerokwis →
FAQ
The kerokwis package is a Python library available on PyPI, primarily intended for penetration testing and related functionalities.
The malicious code in the kerokwis package can exfiltrate basic information such as the host's IP address and username.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed kerokwis, you should uninstall it immediately using the command: 'pip uninstall kerokwis'.
Yes, consider using other penetration testing libraries that do not have known vulnerabilities and are actively maintained.
References
Related vulnerabilities
Recent vulnerabilities recorded for kerokwis.
