Malicious Code Vulnerability in magicwolf Package
Summary
MAL-2026-898: Malicious code in magicwolf (PyPI). Affects magicwolf versions 1.1.8 – 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The magicwolf package, available on PyPI, is designed for specific functionalities within Python applications. However, it has been identified as containing malicious code that can download and execute harmful executables. This vulnerability poses a significant risk to users, as it can lead to unauthorized access and potential data breaches.
Vulnerability Detail
The vulnerability originates from a malicious campaign associated with the magicwolf package, specifically versions 1.1.8 to 1.2.1. The code is crafted to download a hardcoded executable and save it under a generic name in the user's local application data directory. Although the code has the potential to alter security settings and execute the downloaded file, this behavior was not triggered in the analyzed versions. The package also attempts to execute scripts on non-Windows machines, indicating a broader malicious intent. The communication with remote servers and the ability to download executables highlight the serious implications of this vulnerability, including potential data theft and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall magicwolfIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the magicwolf package until a secure version is confirmed. Additionally, monitoring network traffic for unusual activity and employing security software to detect and block malicious downloads can help mitigate risks.
Conclusion
The magicwolf package has been identified as containing malicious code that poses significant risks to users. Immediate action is required to update the package and mitigate potential threats. Regular monitoring and security practices are essential to protect against such vulnerabilities.
See every vulnerability recorded for magicwolf →
FAQ
magicwolf is a Python package available on PyPI, intended for specific functionalities within Python applications.
The vulnerability allows malicious code to download and execute harmful executables, potentially leading to unauthorized access and data breaches.
Immediately update the package to the latest version using 'pip install --upgrade magicwolf' and monitor for any suspicious activity.
Yes, the vulnerability is linked to several domains and URLs that facilitate the download of malicious executables.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. Check your application against known vulnerabilities using the Vulert playground at Vulert Scanner.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
