Critical Malicious Code Vulnerability in myproject-bola Package
Summary
MAL-2026-1091: Malicious code in myproject-bola (PyPI). Affects myproject-bola versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
myproject-bola is a Python package available on PyPI, designed for various functionalities within Python applications. However, it has been compromised, containing malicious code that poses significant security risks. The package is known for its ease of integration and utility in Python projects, but this vulnerability exposes users to severe threats, including data theft and unauthorized system access.
Vulnerability Detail
The vulnerability originates from malicious code embedded in the myproject-bola package, specifically from the source identified as kam193. Upon initiation, the module activates an infostealer that communicates with a Telegram bot, exhibiting RAT-like behavior. It collects sensitive credentials, adds itself to the system's autostart, and is capable of exfiltrating browser data, files, taking screenshots, recording audio, and modifying system configurations. This poses a serious risk to user privacy and system integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall myproject-bolaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the autostart feature of the package and monitor their systems for any unusual activity. Additionally, running antivirus software may help detect and mitigate the effects of the malicious code.
Conclusion
The myproject-bola package has been compromised with malicious code that poses significant security risks. Users are advised to uninstall the package and monitor their systems closely. Utilizing tools like Vulert can aid in identifying and managing vulnerabilities in open-source software.
See every vulnerability recorded for myproject-bola →
FAQ
myproject-bola is a Python package available on PyPI, intended for various functionalities in Python applications.
The vulnerability allows for infostealing, exfiltration of browser data and credentials, and unauthorized access to system functionalities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should uninstall the myproject-bola package immediately and monitor your system for any suspicious activity.
Regularly updating packages, using tools like Vulert to monitor vulnerabilities, and conducting security audits can help prevent future issues.
