Malicious Code Execution Vulnerability in my-super-lib Package
Summary
MAL-2026-1434: Malicious code in my-super-lib (PyPI). Affects my-super-lib versions 0.3.0 – 14.6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
my-super-lib is a Python library available on PyPI that is designed to provide various utility functions for developers. It is widely used for its simplicity and ease of integration into projects. However, recent findings have revealed that certain versions of this package contain malicious code that can compromise user systems.
Vulnerability Detail
The vulnerability originates from a malicious executable that is decrypted and executed during the import of the my-super-lib package. This executable is concealed within an encoded and XORed format in a JSON resource file, making it difficult to detect. The malicious intent behind this vulnerability includes potential data theft and system compromise, aligning with known malware behaviors. This issue is part of a broader campaign targeting users through dependency confusion and typosquatting tactics.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall my-super-libIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid importing the my-super-lib package until they have updated to a secure version. Additionally, consider using alternative libraries that provide similar functionality without the associated risks.
Conclusion
The my-super-lib package has been identified as containing malicious code that poses significant risks to users. It is essential for developers to update to the latest version to protect their systems and data. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source dependencies effectively.
See every vulnerability recorded for my-super-lib →
FAQ
The affected versions include 0.3.0, 0.4.0, 0.6.0, and 14.6.0.
You should immediately update the package to the latest version using the command: pip install --upgrade my-super-lib.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include unauthorized access to sensitive data, system compromise, and the installation of additional malware.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities in your software using just the Pipfile.lock.
