Malicious Code Exfiltration in pymnemonic Package
Summary
MAL-2026-1438: Malicious code in pymnemonic (PyPI). Affects pymnemonic versions 1.1.2 – 1.2.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pymnemonic package, available on PyPI, is designed as a crypto-related helper for Python developers. It aims to assist with mnemonic phrase generation and manipulation, which are commonly used in cryptocurrency applications. However, a malicious clone of this package has been identified, which disguises itself as a legitimate utility while harboring harmful code that exfiltrates sensitive environment variables.
Vulnerability Detail
The vulnerability originates from a malicious modification of the pymnemonic package by a user identified as kam193. This version of the package is a clone of the legitimate python-utils package, but it contains code that secretly sends sensitive environment variables to a hardcoded external location (quantumic.digital). The ramifications of this vulnerability include potential exposure of sensitive data, which could lead to unauthorized access to user accounts or systems that rely on these environment variables.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pymnemonicIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the pymnemonic package until you confirm that you are using a safe version. Additionally, consider using alternative libraries that provide similar functionality without the associated risks.
Conclusion
The pymnemonic package has been compromised by a malicious actor, leading to the exfiltration of sensitive environment variables. It is imperative for users to update to a safe version and remain vigilant about the packages they use in their projects. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for pymnemonic →
FAQ
The pymnemonic package is used for generating and manipulating mnemonic phrases, which are often utilized in cryptocurrency applications for wallet recovery and security.
You can check your installed version of pymnemonic by running 'pip show pymnemonic' in your terminal. Versions 1.1.2, 1.1.3, and 1.2.5 are known to be malicious.
If you have used the affected version, it is crucial to update to a safe version immediately and review your environment variables for any potential exposure.
Yes, you can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. You can check your application against known vulnerabilities without needing to install anything.
Detailed information about this vulnerability can be found in the Open Source Vulnerability database, and you can also visit the Vulert playground to check if your application is affected.
