Malicious Code Vulnerability in rippling-cli: Exfiltration of Host Information
Summary
MAL-2025-192962: Malicious code in rippling-cli (PyPI). Affects rippling-cli versions 1.0.1 – 2.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'rippling-cli' package is a command-line interface tool available on PyPI, designed for interacting with the Rippling platform. It allows users to manage various aspects of their Rippling account through terminal commands. However, this package has been identified as malicious due to its ability to exfiltrate sensitive information from the host system, such as IP addresses and usernames, during installation.
Vulnerability Detail
The vulnerability originates from the malicious code embedded in the 'rippling-cli' package, specifically in version 1.0.1. This code is executed during the installation process, overriding the standard install command in setup.py. The package communicates with a domain associated with malicious activities, posing a risk to users by potentially exposing their system information to unauthorized entities. The primary technical aspect of this vulnerability is its capability to exfiltrate basic data from the system without the user's consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall rippling-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the 'rippling-cli' package altogether until a secure version is released. Additionally, users can monitor their systems for any unusual activity that may arise from the installation of this package.
Conclusion
The 'rippling-cli' package has been identified as malicious due to its ability to exfiltrate sensitive information from users' systems. It is crucial for users to uninstall the affected version and remain vigilant about the packages they install. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for rippling-cli →
FAQ
The 'rippling-cli' package is a command-line interface tool for managing Rippling accounts, allowing users to perform various operations through terminal commands.
The vulnerability allows the package to exfiltrate sensitive information from your system, such as IP addresses and usernames, potentially compromising your privacy and security.
If you have installed the 'rippling-cli' package, you should uninstall it immediately and check for any updates or patches that address the vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground without any signup.
To prevent similar vulnerabilities, always verify the source of packages before installation, keep your dependencies updated, and utilize tools like Vulert for real-time monitoring.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
