Malicious Code Vulnerability in libc-dev Package
Summary
MAL-2026-191: Malicious code in libc-dev (PyPI). Affects libc-dev versions 0.0.0 – 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libc-dev package is a Python library available on the PyPI ecosystem, typically used for development purposes. It is designed to provide essential functionalities for various applications. However, this package has been identified to contain malicious code that compromises user data, specifically by exfiltrating basic information from the host system.
Vulnerability Detail
The vulnerability originates from a malicious implementation within the libc-dev package, specifically in its setup.py file, which overrides the install command to execute harmful code during installation. This code is designed to exfiltrate sensitive information such as the user's IP address and username. The risk associated with this vulnerability is categorized as limited, but it poses a significant threat to user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall libc-devIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the libc-dev package altogether until a secure version is confirmed. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The libc-dev package has been identified as containing malicious code that can exfiltrate sensitive information from users' systems. It is crucial to uninstall the affected versions and update to a secure version to protect your privacy and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for libc-dev →
FAQ
libc-dev is a Python package available on PyPI that is typically used for development purposes.
The vulnerability allows the package to exfiltrate sensitive information such as your IP address and username, compromising your privacy.
You should uninstall the libc-dev package immediately and update to a secure version if available.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
