Malicious Code Vulnerability in moveworks-pipeline-test Package
Summary
MAL-2026-803: Malicious code in moveworks-pipeline-test (PyPI). Affects moveworks-pipeline-test versions 2.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'moveworks-pipeline-test' package is a Python library available on PyPI, designed for testing and development purposes. It is intended to facilitate the integration and testing of various functionalities within the Moveworks ecosystem. However, this package has been identified to contain malicious code that compromises user data and system integrity.
Vulnerability Detail
The vulnerability originates from the package's design, which includes code that exfiltrates sensitive information such as the host's IP address and username upon installation. This malicious behavior is executed by overriding the install command in the setup.py file, allowing it to run arbitrary code during the installation process. The risk level is categorized as low, but it poses a significant threat to user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall moveworks-pipeline-testIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid installing the 'moveworks-pipeline-test' package altogether or run it in a controlled environment where sensitive data is not at risk. Additionally, consider using virtual environments to isolate dependencies.
Conclusion
The 'moveworks-pipeline-test' package contains a vulnerability that allows for the exfiltration of sensitive information during installation. Users are advised to uninstall the package and monitor for updates or patches. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities in the future.
See every vulnerability recorded for moveworks-pipeline-test →
FAQ
It is a Python library designed for testing and development within the Moveworks ecosystem, available on PyPI.
The package exfiltrates sensitive information such as the host's IP address and username during installation.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities without requiring access to the code or installation.
Uninstall the package immediately and check for any patched versions that may be available.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, which can alert you in real-time for open-source vulnerabilities.
