Critical Malicious Code Vulnerability in marocolor Package
Summary
MAL-2026-17900: Malicious code in marocolor (PyPI). Affects marocolor versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marocolor package, available on PyPI, is designed for color manipulation in Python applications. However, it has been found to contain malicious code that compromises user security. This vulnerability allows unauthorized access to sensitive files and can lead to denial-of-service attacks on the user's machine.
Vulnerability Detail
The vulnerability originates from malicious code embedded in the marocolor package. Upon import, it initiates a daemon thread that recursively scans the user's home directory for specific file types, including .env, .key, and .sql, and uploads them to a hardcoded Telegram bot endpoint. Additionally, a second thread executes a fork-bomb-style payload, which spawns new threads in an unbounded loop, exhausting system resources. This behavior is not justified by any legitimate functionality of the package, and users are not prompted for consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall marocolorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks posed by this vulnerability. The best course of action is to uninstall the package entirely.
Conclusion
The marocolor package contains critical vulnerabilities that can lead to unauthorized access to sensitive files and denial-of-service attacks. Users are strongly advised to uninstall the package and monitor their systems for any signs of compromise. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for marocolor →
FAQ
marocolor is a Python package intended for color manipulation in applications, but it has been compromised with malicious code.
The malicious code targets files with extensions such as .env, .key, .config, .sql, .pdf, .docx, .jpg, .png, and .txt.
Upon import, the code scans the user's home directory for specific file types and uploads them to a Telegram bot, while also executing a denial-of-service attack.
The most effective protection is to uninstall the marocolor package immediately and monitor your system for any unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
