Critical Malicious Code Vulnerability in rtcpstream Package
Summary
MAL-2025-191859: Malicious code in rtcpstream (PyPI). Affects rtcpstream versions 1.6.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rtcpstream package, available on PyPI, is designed for handling Real-Time Control Protocol (RTCP) streams in Python applications. It is commonly used in multimedia applications for monitoring and controlling streaming media. However, a recent vulnerability has been discovered that allows malicious code to execute upon importing the module, posing significant security risks to users.
Vulnerability Detail
The vulnerability in the rtcpstream package originates from a malicious code injection by the package maintainer, kam193. When the module is imported, it initiates an infostealer that can exfiltrate sensitive information such as browser data, credentials, and files. This malicious behavior is designed to detect if it is running in a sandbox environment, making it particularly dangerous as it can evade detection in standard security setups.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall rtcpstreamIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid importing the rtcpstream package until a patched version is released. Additionally, consider using alternative libraries for handling RTCP streams that do not have known vulnerabilities.
Conclusion
The rtcpstream package has been compromised with malicious code that poses serious security risks to users. Immediate action is required to mitigate these risks by uninstalling the affected version and monitoring for updates. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities in the future.
See every vulnerability recorded for rtcpstream →
FAQ
The rtcpstream package is used for managing Real-Time Control Protocol streams in Python applications, primarily in multimedia contexts.
The vulnerability allows malicious code to execute, potentially leading to the theft of sensitive information such as credentials and personal data.
You should uninstall the package immediately and refrain from using it until a secure version is released.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. You can check for vulnerabilities in your application using the Vulert playground without any signup.
Detailed information about this vulnerability can be found on the official GitHub repository and vulnerability databases that track malicious packages.
