Critical Malicious Code Vulnerability in remjsonparse Package
Summary
MAL-2026-1290: Malicious code in remjsonparse (PyPI). Affects remjsonparse versions 0.1.0 – 0.1.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The remjsonparse package, available on PyPI, is designed for parsing JSON data in Python applications. However, it has been compromised to include malicious code that can exfiltrate sensitive information and execute remote commands. This vulnerability poses a significant risk to users who import this package, as it can lead to unauthorized access and data breaches.
Vulnerability Detail
The vulnerability originates from a malicious actor who has inserted code into the remjsonparse package. Upon import, this code initiates actions that compromise the user's system, including exfiltrating AWS and git credentials, command history, and security tools in use. It also establishes a connection to a command and control (C2) server, allowing for further remote commands to be executed. The malicious code is capable of configuring persistence mechanisms, such as autostart keys, crontabs, or Linux services, and can set up new SSH credentials for unauthorized remote access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall remjsonparseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds to mitigate the effects of this vulnerability. The best course of action is to uninstall the remjsonparse package and refrain from using it until a secure alternative is found.
Conclusion
The remjsonparse package contains a critical vulnerability due to the presence of malicious code that can compromise user systems. Users are strongly advised to uninstall the package immediately and seek alternative solutions. Continuous monitoring for vulnerabilities is essential to maintain the security of your applications.
See every vulnerability recorded for remjsonparse →
FAQ
remjsonparse is a Python package designed for parsing JSON data, but it has been compromised to include malicious code.
The malicious code can exfiltrate sensitive information, execute remote commands, and establish unauthorized access to your system.
Immediately uninstall the remjsonparse package using the command pip uninstall remjsonparse and avoid using it until a secure alternative is available.
Currently, there are no patched versions available for remjsonparse. It is advised to avoid using this package altogether.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using the Pipfile.lock. You can check for vulnerabilities in your application using the Vulert playground at Vulert Scanner without needing to sign up.
