Malicious Code Injection in queeuees Package - PyPI Vulnerability
Summary
MAL-2026-17286: Malicious code in queeuees (PyPI). Affects queeuees versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The queeuees package, available on PyPI, is designed for managing queues in Python applications. It is intended to simplify the handling of asynchronous tasks. However, the package has been found to contain malicious code that can compromise the integrity of the system it is installed on. This vulnerability poses a significant risk to users who may unknowingly install the affected version.
Vulnerability Detail
The vulnerability originates from an obfuscated code snippet within the queeuees package. This code iterates over all files in the system and appends a comment to every .py file found, effectively modifying system files without user consent. This malicious behavior can lead to unauthorized access, data leakage, or further exploitation of the system. The campaign associated with this vulnerability has been categorized as malicious due to its intent to modify user systems covertly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall queeueesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually inspect their Python files for any unauthorized modifications and revert them if necessary. Additionally, consider using a virtual environment to isolate dependencies and minimize the risk of system-wide changes.
Conclusion
The queeuees package has been identified as containing malicious code that modifies system files without consent. Users are strongly advised to uninstall the package and monitor their systems for any unauthorized changes. Utilizing tools like Vulert can help in identifying and managing vulnerabilities in open-source software.
See every vulnerability recorded for queeuees →
FAQ
The queeuees package is a Python library designed to help manage queues for asynchronous tasks in applications.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which allows you to monitor for vulnerabilities without requiring any signup.
If you have the queeuees package installed, you should uninstall it immediately and check for any unauthorized changes in your Python files.
As of now, there is no specific patch mentioned for the queeuees package. Users are advised to uninstall the package until further notice.
To prevent similar vulnerabilities, regularly monitor your dependencies using tools like Vulert, which can alert you to open-source vulnerabilities in real-time.
