Malicious Code Vulnerability in researchpoc Package
Summary
MAL-2026-504: Malicious code in researchpoc (PyPI). Affects researchpoc versions 99.99.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The researchpoc package, available on PyPI, is designed as a proof of concept (PoC) for research purposes, particularly in the realm of dependency confusion. However, it has been found to contain obfuscated code that makes it difficult to verify its true intent. This raises significant security concerns as the package may execute harmful operations during installation.
Vulnerability Detail
The vulnerability stems from the package overriding the install command in its setup.py file, allowing it to execute malicious code during the installation process. This malicious code is designed to exfiltrate environment variables and other generic data, posing a risk of data theft. The obfuscation of the code complicates the verification process, making it challenging for users to identify the malicious behavior. Additionally, the package is associated with typosquatting, which can mislead users into installing it under false pretenses.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall researchpocIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can monitor their environment for any unauthorized access or data exfiltration. Additionally, consider using tools like Vulert to check for vulnerabilities in your dependencies. You can use the following command to check for vulnerabilities in your Pipfile.lock: 'vulert check'.
Conclusion
The researchpoc package presents a significant security risk due to its malicious code and obfuscation. Users are strongly advised to avoid this package and ensure their systems are secure by monitoring for vulnerabilities. Utilizing tools like Vulert can help maintain awareness of potential threats.
See every vulnerability recorded for researchpoc →
FAQ
The researchpoc package is a proof of concept tool available on PyPI, intended for research on dependency confusion.
The vulnerability allows malicious code to execute during installation, potentially leading to data theft and unauthorized access to environment variables.
If you have installed researchpoc, you should uninstall it immediately using 'pip uninstall researchpoc' and monitor your environment for any suspicious activity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
It is advisable to use well-known and trusted packages that have a good reputation and are actively maintained. Always verify the source before installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for researchpoc.
