Malicious Code Vulnerability in polyclawd Package
Summary
MAL-2026-927: Malicious code in polyclawd (PyPI). Affects polyclawd versions 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The polyclawd package, available on PyPI, is designed for various functionalities within Python applications. However, it has been identified as containing malicious code that poses significant security risks. This vulnerability allows the package to download and execute remote executables, potentially compromising user systems and data.
Vulnerability Detail
The vulnerability originates from a malicious implementation in the polyclawd package, specifically in version 1.1.0. It is designed to download a hardcoded executable and save it in the user's local application data directory under a generic name, aiming to obscure its presence. Although the code has the capability to alter security settings and execute the downloaded file, this behavior was not triggered in the analyzed versions. The package communicates with a remote server to fetch additional malicious payloads, which could lead to further exploitation. The presence of typosquatting and attempts to execute scripts on non-Windows machines further complicates the threat landscape.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall polyclawdIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can uninstall the polyclawd package to prevent any potential exploitation. Use the following command: 'pip uninstall polyclawd'. Additionally, monitor your application for any suspicious activity and consider using a firewall to block outgoing connections to known malicious domains.
Conclusion
The polyclawd package has been identified as containing malicious code that poses significant security risks to users. It is crucial to take immediate action by uninstalling the package and monitoring your systems. Regularly updating your packages and using tools like Vulert can help safeguard against such vulnerabilities in the future.
See every vulnerability recorded for polyclawd →
FAQ
Polyclawd is a Python package available on PyPI, designed for various functionalities in Python applications.
The vulnerability allows the package to download and execute malicious executables, potentially compromising user systems and data.
You should immediately uninstall the package and monitor your system for any unusual activity. Consider updating to a patched version if available.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The consequences include unauthorized access to user systems, data theft, and the potential for further exploitation through downloaded malicious payloads.
