Malicious Code Detected in marshl Package: Remote Control Threat
Summary
MAL-2026-623: Malicious code in marshl (PyPI). Affects marshl versions 0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marshl package, available on PyPI, is marketed as a speed testing tool or a Telegram library. However, it has been identified as a typosquatted package that masquerades as a legitimate library while harboring malicious intent. The package includes a Telegram bot designed to execute remote control commands on the user's computer, posing significant security risks.
Vulnerability Detail
The marshl package contains malicious code that downloads and executes a remote script, effectively turning the user's machine into a remote access trojan (RAT). This vulnerability originated from a campaign identified as '2025-10-speedd-testing-bot', which exploits typosquatting to deceive users into installing the compromised package. The potential ramifications include unauthorized access to sensitive data and control over the affected system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall marshlIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative libraries for speed testing or Telegram bot development that are well-reviewed and have a strong community backing. Avoid using the marshl package until it is confirmed safe.
Conclusion
The marshl package has been identified as a malicious tool that poses significant security risks by enabling remote control of affected systems. Users are advised to uninstall the package immediately and seek alternatives. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for marshl →
FAQ
The marshl package is a Python library that was intended for speed testing and Telegram bot functionalities but has been compromised with malicious code.
If you have installed the marshl package, your system may be at risk. You can check for vulnerabilities using Vulert, which monitors open-source vulnerabilities in real-time.
Uninstall the marshl package immediately using 'pip uninstall marshl' and consider using alternative libraries.
The malicious code in marshl downloads and executes a remote script, allowing attackers to gain unauthorized access to your computer.
Always verify the source of packages before installation and consider using tools like Vulert to monitor for vulnerabilities in your dependencies.
