Malicious Code Exfiltration in lanchain-openai Package
Summary
MAL-2025-192699: Malicious code in lanchain-openai (PyPI). Affects lanchain-openai versions 0.0.0 – 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lanchain-openai is a Python package available on PyPI, designed for integrating OpenAI functionalities into applications. It aims to simplify the use of OpenAI's API for developers. However, the package has been found to contain malicious code that compromises user data, making it a significant security concern.
Vulnerability Detail
The vulnerability originates from the package's code, which exfiltrates basic information about the host system, such as IP addresses and usernames. This malicious behavior is executed during the installation process, as the package overrides the install command in setup.py to run the harmful code. The risk is categorized as limited, but it poses a potential threat to user privacy and system security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall lanchain-openaiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the lanchain-openai package until a secure version is released. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The lanchain-openai package has been identified as containing malicious code that can exfiltrate sensitive information from users' systems. It is crucial for users to uninstall the affected versions and monitor for any secure updates. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source packages.
See every vulnerability recorded for lanchain-openai →
FAQ
lanchain-openai is a Python package designed to facilitate the integration of OpenAI's API into applications.
The malicious code exfiltrates basic information such as the host's IP address and username.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Uninstall the affected versions of lanchain-openai and check for a secure version to install.
While the risk is categorized as limited, it is advisable to uninstall the package to protect your data and privacy.
