Malicious Code Vulnerability in license-utils-kit Package
Summary
MAL-2026-2084: Malicious code in license-utils-kit (PyPI). Affects license-utils-kit versions 0.1a0 – 0.1rc1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The license-utils-kit package, available on PyPI, is a utility designed to manage software licenses. It aims to provide developers with tools to easily handle license information for various projects. However, a malicious clone of the legitimate 'license' package has been identified, which poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious clone of the legitimate 'license' package, created by the user kam193. When the find_by_key function is invoked, it loads strongly obfuscated code that collects sensitive data from users' cryptowallets and password managers. This information is then exfiltrated to a hardcoded remote location. Prior to version 0.1b2, the malicious code was hosted externally and downloaded upon triggering, increasing the risk of exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall license-utils-kitIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid using the license-utils-kit package until a secure version is confirmed. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The license-utils-kit package has been identified as a malicious clone that poses significant security risks to users. It is essential to update or remove the package and monitor for vulnerabilities using tools like Vulert to ensure the safety of your applications.
See every vulnerability recorded for license-utils-kit →
FAQ
The license-utils-kit package is a utility designed to help developers manage software licenses for their projects.
The malicious code operates by loading obfuscated files that collect sensitive information from users' cryptowallets and password managers when specific functions are called.
If you have installed the license-utils-kit package, it is crucial to uninstall it immediately and check for any unauthorized access to your sensitive information.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Using compromised packages can lead to data breaches, unauthorized access to sensitive information, and potential financial loss due to the exfiltration of credentials.
