Critical Malicious Code Vulnerability in leakdeep Package
Summary
MAL-2026-17921: Malicious code in leakdeep (PyPI). Affects leakdeep versions 2.5.0 – 2.6.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The leakdeep package is marketed as an OSINT and credential-leak intelligence framework, designed to assist users in searching for leaked credentials. It features a command-line interface (CLI) for executing searches. However, the package has been found to contain malicious code that compromises user data and system integrity.
Vulnerability Detail
The vulnerability originates from the leakdeep package, which deceptively presents itself as a legitimate tool while embedding malicious functionalities. The CLI invokes a background thread that performs unauthorized actions on Windows systems, including collecting sensitive browser data, capturing screenshots, and exfiltrating this information to a hardcoded Discord webhook. The malicious code circumvents user consent and operates under the guise of a non-functional search feature, posing significant risks to user privacy and data security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall leakdeepIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability. The best course of action is to uninstall the leakdeep package entirely and refrain from using any unverified packages that may pose similar risks.
Conclusion
The leakdeep package contains critical malicious code that poses significant risks to user data and system integrity. Users are strongly advised to uninstall the package and consider secure alternatives for their OSINT needs. Continuous monitoring for vulnerabilities is essential to maintain software security.
See every vulnerability recorded for leakdeep →
FAQ
The leakdeep package is a tool intended for OSINT and credential-leak intelligence, providing a CLI for searching leaked credentials.
The vulnerability allows the package to collect sensitive information from your browsers and system without your consent, potentially leading to data breaches.
You should uninstall the leakdeep package immediately using the command pip uninstall leakdeep.
Yes, consider using reputable OSINT tools that are well-reviewed and have a strong security track record.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the Pipfile.lock. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
