Malicious Code Vulnerability in libseal Package
Summary
MAL-2026-18132: Malicious code in libseal (PyPI). Affects libseal versions 1.1.0 – 1.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libseal is a Python package available on PyPI that provides algorithms for encryption and decryption. It is often used in applications requiring secure data handling. However, recent investigations have revealed that libseal is part of a malicious campaign, where it serves as a conduit for executing encrypted payloads from another package, iterquarry.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the libseal package, which is designed to decrypt and execute an encrypted payload. This payload was previously hardcoded to communicate with a Discord bot, but in version 2.2.0 and later, the decryption key is no longer embedded, leaving the payload's nature unknown. This poses significant risks, including potential data theft and unauthorized access to user systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall libsealIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the libseal package until a patched version is confirmed. Consider using alternative libraries for encryption and decryption that do not have known vulnerabilities.
Conclusion
The libseal package has been identified as part of a malicious campaign, posing serious security risks. Users are advised to update to a secure version or find alternative solutions until the issue is resolved. Monitoring tools like Vulert can help keep your applications safe from such vulnerabilities.
See every vulnerability recorded for libseal →
FAQ
libseal is a Python package that provides encryption and decryption algorithms, commonly used in applications requiring secure data handling.
The vulnerability allows malicious code to execute within your application, potentially leading to data theft or unauthorized access.
Immediately update the libseal package to the latest version or consider removing it until a secure version is available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. Visit https://vulert.com for more information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
