Malicious Code Execution in prateek-yadav23 Package on PyPI
Summary
MAL-2026-1277: Malicious code in prateek-yadav23 (PyPI). Affects prateek-yadav23 versions 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The prateek-yadav23 package is a Python library available on the Python Package Index (PyPI). It is designed for various purposes, potentially including testing and exploration in pentesting scenarios. However, this package has been identified as containing malicious code that executes during installation, posing a significant security risk to users who install it.
Vulnerability Detail
The vulnerability originates from the package's setup.py file, which overrides the install command to execute malicious code when the package is installed. This behavior can lead to unauthorized actions on the user's system, including data theft or system compromise. The package has been categorized under PROBABLY_PENTEST due to its suspicious activity, although it does not present immediate real harm. Users should be cautious when installing packages that exhibit such behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall prateek-yadav23If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can monitor their environment for any unauthorized changes or activities after installation. It is advisable to use virtual environments to isolate package installations and minimize potential risks.
Conclusion
The prateek-yadav23 package on PyPI has been identified as containing malicious code that executes during installation. Users should avoid installing this package and remove it if already installed. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for prateek-yadav23 →
FAQ
The prateek-yadav23 package is a Python library available on PyPI, potentially used for testing and exploration in pentesting.
The vulnerability allows malicious code to execute during the installation of the package, which can compromise the user's system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you have installed the prateek-yadav23 package, you should uninstall it immediately using 'pip uninstall prateek-yadav23'.
Always use trusted packages, check for updates, and consider using tools like Vulert to monitor for vulnerabilities in your dependencies.
