Critical Infostealer Vulnerability in pyclogger Package
Summary
MAL-2026-1099: Malicious code in pyclogger (PyPI). Affects pyclogger versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyclogger is a Python package available on PyPI that is designed for logging and tracking application events. It is commonly used by developers to monitor application performance and troubleshoot issues. However, a recent discovery has revealed that the package contains malicious code that compromises user security by exfiltrating sensitive information.
Vulnerability Detail
The vulnerability originates from a malicious code embedded within the pyclogger package, specifically in version 0.1.0. This code functions as an infostealer, targeting Discord tokens and saved browser credentials. It sends this sensitive information to a hardcoded location, posing significant risks to users' privacy and security. The implications of this vulnerability are severe, as it can lead to unauthorized access to user accounts and data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pycloggerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should consider uninstalling the pyclogger package until a secure version is confirmed. This can be done using the command: 'pip uninstall pyclogger'. Additionally, monitor your system for any unauthorized access or unusual activity.
Conclusion
The pyclogger package has been identified as containing malicious code that compromises user security by stealing sensitive information. Users are advised to uninstall the package and monitor their systems for any signs of unauthorized access. Keeping software updated and utilizing tools like Vulert can help mitigate such risks in the future.
See every vulnerability recorded for pyclogger →
FAQ
The vulnerability is a malicious code that acts as an infostealer, exfiltrating sensitive information such as Discord tokens and browser credentials.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed pyclogger, it is recommended to uninstall the package immediately and monitor your system for any unauthorized access.
As of now, there is no patched version available. It is essential to stay updated with the official repository for any future releases.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock, allowing you to stay informed about potential risks.
