Malicious Code Execution Vulnerability in lyroxpy Package
Summary
MAL-2026-841: Malicious code in lyroxpy (PyPI). Affects lyroxpy versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lyroxpy package, available on PyPI, is designed for Python developers to facilitate specific functionalities within their applications. However, it has been identified to contain malicious code that executes an embedded archive upon import, posing significant security risks to users. The package's primary attributes include its ease of installation and integration into Python projects, but its recent vulnerability has raised concerns about its safety and reliability.
Vulnerability Detail
The vulnerability originates from the inclusion of an embedded archive within the lyroxpy package that contains an executable. When the module is imported, this archive is executed, leading to the extraction of the executable to a temporary file. The code maintains an open file handler and deletes the original file, creating the illusion that it no longer exists. This behavior allows the malicious executable to run, which could potentially lead to unauthorized access or data theft. The campaign has been classified as malicious due to its obfuscation techniques and intent to cover tracks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall lyroxpyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid importing the lyroxpy package until a secure version is released. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The lyroxpy package has been identified with a serious vulnerability that allows malicious code execution, posing significant risks to users. It is crucial to update the package to a secure version and consider alternative solutions until the issue is resolved. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for lyroxpy →
FAQ
lyroxpy is a Python package available on PyPI, designed to assist developers with specific functionalities in their applications.
The vulnerability allows malicious code to execute on your system, potentially leading to unauthorized access, data theft, or other harmful actions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If an immediate update is not possible, refrain from using the lyroxpy package and look for alternative solutions until a secure version is available.
Detailed information about this vulnerability can be found on the official GitHub repository and the Open Source Vulnerability database.
