Malicious Code Injection in lium-io-gztensor Package - A Critical Vulnerability
Summary
MAL-2026-55: Malicious code in lium-io-gztensor (PyPI). Affects lium-io-gztensor versions 0.0.3 – 4.96. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lium-io-gztensor package is a Python library available on PyPI, designed to facilitate tensor operations and computations. However, it has been identified as a typosquatting package that mimics a legitimate library, embedding malicious code aimed at compromising user systems. This vulnerability poses significant risks to users who may unknowingly install the package, as it can lead to unauthorized access and data theft.
Vulnerability Detail
The vulnerability stems from a malicious campaign that utilizes typosquatting techniques to create a deceptive package. The lium-io-gztensor package was found to clone a legitimate library and embed hidden code that downloads a malicious script. This script subsequently retrieves an archive containing a malicious executable tailored to the system architecture, ensuring persistence by creating automatically started service entries. The malicious code is linked to a Go-based infostealer and backdoor, previously associated with North Korean cybercrime activities. The threat is exacerbated by the fact that the malicious code is not present in the initial package but is introduced through updates.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall lium-io-gztensorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can monitor their systems for any unauthorized processes or services that may have been created by the malicious code. It is advisable to run antivirus scans and check for any unusual network activity that may indicate a compromise.
Conclusion
The lium-io-gztensor package has been identified as a malicious entity that poses significant risks to users through its embedded malicious code. It is crucial for users to uninstall this package and remain vigilant about the sources from which they install software. Utilizing tools like Vulert can enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for lium-io-gztensor →
FAQ
Typosquatting is a malicious practice where attackers create fake packages that closely resemble legitimate ones, hoping users will mistakenly install them due to typographical errors.
You can check your installed packages by running the command pip list in your terminal. Look for 'lium-io-gztensor' in the list.
If you suspect a compromise, immediately disconnect from the internet, run a full antivirus scan, and consult with a cybersecurity professional for further assistance.
Yes, tools like Vulert can help monitor and alert you in real-time for open-source vulnerabilities in your software. You can use the Vulert playground to check if your application is affected by this vulnerability.
The risks include unauthorized access to sensitive data, installation of backdoors, and potential data theft, which can have severe implications for both individuals and organizations.
