Dependency Confusion Vulnerability in mkdocs-dataopslive Package
Summary
MAL-2026-614: Malicious code in mkdocs-dataopslive (PyPI). Affects mkdocs-dataopslive versions 0.0.0 – 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mkdocs-dataopslive package is a Python library available on PyPI, designed to enhance documentation workflows with MkDocs. It allows users to manage and visualize data operations effectively. However, it has been identified as vulnerable to dependency confusion attacks, which can lead to malicious code execution.
Vulnerability Detail
The mkdocs-dataopslive package contains malicious code that exploits dependency confusion. This vulnerability arises from the package's ability to send beacon requests that report usage back to an external source. While it does not exfiltrate sensitive information, it poses a risk by potentially allowing attackers to monitor usage patterns. The vulnerability is categorized under 'PROBABLY_PENTEST', indicating it resembles typical penetration testing packages but carries low-harm possibilities. The origin of this vulnerability is linked to typosquatting and dependency confusion tactics employed by the package's creator.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall mkdocs-dataopsliveIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, consider removing mkdocs-dataopslive from your project or replacing it with a trusted alternative until a fix is applied.
Conclusion
The mkdocs-dataopslive package has been identified as vulnerable to dependency confusion attacks, which can lead to malicious code execution. Users are advised to update the package to the latest version or consider workarounds until a fix is available. Regular monitoring of dependencies is crucial for maintaining application security.
See every vulnerability recorded for mkdocs-dataopslive →
FAQ
Dependency confusion is a type of attack where an attacker publishes a malicious package with the same name as a legitimate package in a public repository, tricking systems into downloading the malicious version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update mkdocs-dataopslive, consider removing it from your project or using a trusted alternative until a patch is available.
While the package does not exfiltrate sensitive information, it can still pose a risk by allowing attackers to monitor usage patterns. It is advisable to address the vulnerability promptly.
The vulnerability was reported by Kamil Mańkowski (kam193), who is actively monitoring and documenting malicious packages.
