Malicious Code Execution in py2ops Package
Summary
MAL-2026-17807: Malicious code in py2ops (PyPI). Affects py2ops versions 2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The py2ops package, available on PyPI, is designed to provide a console command named 'python2' that functions as a REPL (Read-Eval-Print Loop) for Python 2. It allows users to execute Python code interactively. However, this package has been found to contain malicious code that compromises user security by sending sensitive information to an external server.
Vulnerability Detail
The vulnerability originates from the package's functionality that registers the user's hostname and operating system to a remote server upon the first execution. The command 'python2' allows users to input code, which is then sent to the server. The server responds with a payload that is downloaded and executed in memory, potentially leading to arbitrary code execution. This behavior is hidden behind misleading error messages, making it difficult for users to detect the malicious activity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall py2opsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'python2' command and instead utilize a different Python interpreter that is not affected by this vulnerability. Additionally, ensure that your environment is secure and monitor for any unusual activity.
Conclusion
The py2ops package contains a serious vulnerability that allows for malicious code execution and unauthorized data transmission. Users are advised to uninstall the package and monitor their systems for any unusual activity. Utilizing tools like Vulert can help in identifying such vulnerabilities in your applications.
See every vulnerability recorded for py2ops →
FAQ
The py2ops package is a Python package that provides a console command for executing Python 2 code interactively.
The vulnerability allows the package to send user information to a remote server and execute malicious code without the user's consent.
You should uninstall the py2ops package immediately to prevent any potential security risks.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to your system, execution of arbitrary code, and potential data breaches.
