Critical Malicious Code Vulnerability in queryservice-client Package
Summary
MAL-2026-5: Malicious code in queryservice-client (PyPI). Affects queryservice-client versions 0.1.0 – 2.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The queryservice-client package is a Python library available on PyPI, designed to facilitate interactions with various query services. It is commonly used in applications that require querying databases or APIs. However, this package has been found to contain malicious code that can compromise sensitive information during installation.
Vulnerability Detail
The vulnerability originates from a dependency confusion attack executed by the package's maintainer, kam193. The malicious code is embedded in the setup.py file, which overrides the install command to execute harmful scripts during the installation process. This can lead to the exfiltration of sensitive environment variables and other generic data, posing significant security risks to users who install the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall queryservice-clientIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the queryservice-client package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The queryservice-client package has been identified as containing malicious code that can compromise sensitive information during installation. Users are advised to update to a secure version and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for queryservice-client →
FAQ
The malicious code is designed to exfiltrate sensitive environment variables and execute harmful scripts during installation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed a vulnerable version, it is crucial to uninstall it immediately and update to a secure version of the package.
Using the compromised package can lead to data breaches, unauthorized access to sensitive information, and potential exploitation of your application.
To prevent similar vulnerabilities, always verify the source of packages, use dependency management tools, and regularly monitor for updates and security advisories.
