Malicious Code Detected in python-files-mod Package - Data Exfiltration Risk
Summary
MAL-2026-851: Malicious code in python-files-mod (PyPI). Affects python-files-mod versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-files-mod package, available on PyPI, is designed for file system manipulation. It is intended to provide developers with tools to manage files and directories efficiently. However, this package has been compromised, containing obfuscated code that communicates with a Telegram channel, indicating a potential data exfiltration threat.
Vulnerability Detail
The vulnerability originates from a malicious actor, identified as kam193, who disguised the package as a legitimate file system manipulation library. The obfuscated code within the package is designed to communicate with a Telegram channel, suggesting that it may be used for data exfiltration. The presence of obfuscation techniques raises significant concerns about the package's integrity and the potential for unauthorized data access or theft.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall python-files-modIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the python-files-mod package until a secure version is released. Consider using alternative libraries for file system manipulation that are known to be safe and well-maintained.
Conclusion
The python-files-mod package has been identified as containing malicious code that poses a risk of data exfiltration. Users are advised to remove the package and monitor for updates or patches. Utilizing tools like Vulert can help in identifying vulnerabilities in your software without the need for complex setups.
See every vulnerability recorded for python-files-mod →
FAQ
The python-files-mod package is a library for file system manipulation, allowing developers to manage files and directories.
The vulnerability is classified as malicious, involving obfuscated code that communicates with a Telegram channel for potential data exfiltration.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed python-files-mod, it is recommended to uninstall the package immediately and refrain from using it until a secure version is released.
Yes, consider using other well-known and trusted libraries for file system manipulation, such as os or shutil, which are part of the Python standard library.
