Malicious Code Vulnerability in prometheus-analysis Package
Summary
MAL-2026-1907: Malicious code in prometheus-analysis (PyPI). Affects prometheus-analysis versions 0.1.0 – 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The prometheus-analysis package is a Python library available on PyPI, designed for analyzing Prometheus metrics. It provides functionalities that help developers and data analysts to extract insights from monitoring data. However, this package has been identified to contain malicious code, posing significant security risks to users who integrate it into their applications.
Vulnerability Detail
The vulnerability originates from malicious code embedded within specific versions of the prometheus-analysis package (0.1.0, 0.1.1, 0.1.2). This code can lead to unauthorized access, data breaches, or system compromise. Users who have installed these versions may unknowingly expose their systems to attackers, resulting in potential data loss or manipulation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall prometheus-analysisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the affected versions of the package from their environment. This can be done using the command: 'pip uninstall prometheus-analysis'. It is advisable to avoid using the package until a secure version is confirmed.
Conclusion
The discovery of malicious code in the prometheus-analysis package highlights the importance of monitoring open-source dependencies for vulnerabilities. Users are urged to take immediate action by updating or removing affected versions to safeguard their applications.
See every vulnerability recorded for prometheus-analysis →
FAQ
prometheus-analysis is a Python library for analyzing Prometheus metrics, helping users extract insights from monitoring data.
The affected versions are 0.1.0, 0.1.1, and 0.1.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
You should uninstall the affected version and update to a patched version as soon as possible.
More information can be found on the GitHub repository of the Open Source Security Foundation or by checking the vulnerability details on Vulert.
