Malicious Code Exfiltration in osopackagepy Package
Summary
MAL-2026-860: Malicious code in osopackagepy (PyPI). Affects osopackagepy versions 10.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The osopackagepy package, available on PyPI, is designed for Python developers to facilitate various operations. However, it has been identified as malicious due to its capability to exfiltrate sensitive information from the host system, such as IP addresses and usernames. This vulnerability arises from the package's design, which overrides the installation command to execute harmful code during the installation process.
Vulnerability Detail
The osopackagepy package contains malicious code that exfiltrates basic information about the host system upon installation. The vulnerability originates from the package's installation script, which has been modified to execute harmful actions. This includes communicating with a domain associated with malicious activities, posing a risk to users who install the package. The primary technical aspect of this vulnerability is the overridden install command in the setup.py file, which allows the execution of the malicious code during the package installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall osopackagepyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no workarounds to mitigate the effects of this vulnerability other than avoiding the installation of the osopackagepy package altogether.
Conclusion
The osopackagepy package poses a significant risk due to its malicious code that exfiltrates sensitive information from users' systems. Immediate uninstallation is necessary to protect against potential data breaches. Users are advised to remain vigilant and utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for osopackagepy →
FAQ
osopackagepy is a Python package available on PyPI that has been identified as malicious due to its ability to exfiltrate sensitive information from the host system.
The vulnerability manifests when the package is installed, as it executes malicious code that collects and sends sensitive information from the host system.
If you have installed osopackagepy, you should uninstall it immediately using the command: pip uninstall osopackagepy.
No, there is currently no patched version of osopackagepy available. It is recommended to avoid this package entirely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
