Malicious Code Injection in python-module-installer: A Threat to Python Package Security
Summary
MAL-2026-1263: Malicious code in python-module-installer (PyPI). Affects python-module-installer versions 3.15.10 – 3.15.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-module-installer is a package available on PyPI that is intended to facilitate the installation of Python modules. However, this package has been compromised, cloning a legitimate library (webdavclient3) and modifying it to serve as a malicious installer. The malicious version exfiltrates sensitive information from the user's environment, posing a significant risk to users and their data.
Vulnerability Detail
The vulnerability originates from the malicious code embedded within the python-module-installer package. During installation, it exfiltrates the current working directory to a remote WebDAV server or a Telegram Bot. Additionally, it targets cryptocurrency operations, injecting code into specific files to exfiltrate configuration files during cryptocurrency exchange operations. This poses severe risks, including data theft and unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall python-module-installerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the python-module-installer package altogether and manually install the required modules from trusted sources. Ensure to check the integrity of any packages before installation.
Conclusion
The python-module-installer package has been identified as malicious, posing significant risks to users through data exfiltration and unauthorized access. It is crucial for users to uninstall this package and replace it with legitimate alternatives to safeguard their systems.
See every vulnerability recorded for python-module-installer →
FAQ
The python-module-installer is a package designed to help users install Python modules easily. However, the version in question has been compromised.
The vulnerability allows malicious code to exfiltrate sensitive information from your system, potentially leading to data theft and unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have installed the python-module-installer, you should uninstall it immediately and replace it with a legitimate package.
For more information on vulnerabilities and how to protect your applications, you can visit Vulert's website at https://vulert.com.
