Malicious Code Vulnerability in rzr-home Package - Exfiltration of Host Information
Summary
MAL-2026-845: Malicious code in rzr-home (PyPI). Affects rzr-home versions 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rzr-home package, available on PyPI, is designed for specific functionalities related to home automation and system management. However, it has been identified to contain malicious code that compromises user privacy by exfiltrating sensitive information such as IP addresses and usernames from the host system during installation.
Vulnerability Detail
The rzr-home package contains malicious code that executes upon installation, overriding the default install command in setup.py. This code is designed to exfiltrate basic information about the host, posing a risk to user privacy. The vulnerability originates from the package's source, attributed to the user kam193, and is categorized as a low-risk pentesting package. Despite its limited risk, the potential for unauthorized data access remains a concern.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall rzr-homeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid installing the rzr-home package altogether. If you have already installed it, you can remove it using the command: 'pip uninstall rzr-home'. Additionally, consider using a virtual environment to isolate your projects and minimize the risk of malicious package installations.
Conclusion
The rzr-home package has been identified to contain malicious code that compromises user privacy by exfiltrating sensitive information. It is crucial for users to uninstall this package and remain vigilant about the security of their Python environments. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for rzr-home →
FAQ
The rzr-home package is a Python library available on PyPI, intended for home automation and system management tasks.
The vulnerability allows the package to exfiltrate sensitive information such as your IP address and username, compromising your privacy.
You should uninstall the rzr-home package immediately using 'pip uninstall rzr-home' and check for any updates or patches.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software without requiring code access. You can check your application against known vulnerabilities using the Vulert playground.
Regularly update your packages, use virtual environments, and monitor for vulnerabilities using tools like Vulert to maintain a secure Python environment.
