Malicious Code Injection in rowrapee Package: Adware Threat Detected
Summary
MAL-2026-2122: Malicious code in rowrapee (PyPI). Affects rowrapee versions 1.21 – 1.22. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rowrapee package, available on PyPI, is designed for specific functionalities within Python applications. However, it has been compromised, embedding malicious code that downloads and executes harmful scripts. This vulnerability poses a significant risk to users, as it can lead to the installation of adware and other malicious software on their systems.
Vulnerability Detail
The vulnerability originates from a malicious actor identified as kam193, who has hidden code within the rowrapee package. This code is designed to download and execute a remote script containing malware, specifically adware. The triggering mechanism appears to be linked to the presence of a PTH file, although this file is not always necessary for the exploit to occur. The malicious campaign is categorized as having clear malicious intent, with the potential to compromise user data and system integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall rowrapeeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the rowrapee package altogether until a secure version is confirmed. Additionally, ensure that your environment is monitored for any unexpected behavior that may indicate the presence of the malicious script.
Conclusion
The rowrapee package has been compromised, embedding malicious code that poses a significant risk to users. Immediate action is required to update the package and mitigate potential threats. Utilizing tools like Vulert can enhance your security posture by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for rowrapee →
FAQ
rowrapee is a Python package available on PyPI, designed for specific functionalities within Python applications.
The vulnerability allows malicious code to download and execute adware on your system, potentially compromising your data and privacy.
If you have installed versions 1.21 or 1.22 of rowrapee, you should uninstall these versions and upgrade to a secure version immediately.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
Regularly updating your packages, using tools like Vulert for monitoring, and conducting security audits can help prevent vulnerabilities.
