Malicious Code Exfiltration in s3transfer-sl Package
Summary
MAL-2025-191861: Malicious code in s3transfer-sl (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The s3transfer-sl package is a Python library available on PyPI, designed to facilitate the transfer of files to and from Amazon S3. However, this package has been identified as a malicious clone of the legitimate s3transfer package, which is widely used for secure and efficient file transfers. The malicious variant poses a significant risk by attempting to exfiltrate sensitive environment variables and tokens from the Azure metadata API during installation.
Vulnerability Detail
The vulnerability originates from the s3transfer-sl package, which contains malicious code that executes upon installation. This code is designed to extract sensitive information, such as environment variables and tokens, from the Azure metadata API. The ramifications of this vulnerability are severe, as it can lead to unauthorized access to cloud resources and potential data breaches. The package is a clear case of typosquatting, where a malicious actor creates a package with a name similar to a legitimate one to deceive users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall s3transfer-slIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the malicious package and ensuring that you are using the correct, legitimate package. Always verify package names before installation to avoid typosquatting risks.
Conclusion
The s3transfer-sl package poses a significant security risk due to its malicious intent to exfiltrate sensitive information. Users are strongly advised to uninstall this package and switch to the legitimate s3transfer package. Regular monitoring of dependencies using tools like Vulert can help prevent future vulnerabilities.
See every vulnerability recorded for s3transfer-sl →
FAQ
s3transfer-sl is a malicious Python package that mimics the legitimate s3transfer package, designed for transferring files to and from Amazon S3.
The vulnerability allows the malicious package to exfiltrate sensitive information from your environment, potentially leading to unauthorized access to your cloud resources.
You should uninstall the s3transfer-sl package immediately and install the legitimate s3transfer package to secure your application.
Always verify the package name and source before installation. Consider using tools like Vulert to monitor for vulnerabilities in your dependencies.
Vulert is a monitoring tool that uses your Pipfile.lock to alert you in real-time about open-source vulnerabilities in your software. You can check for vulnerabilities without signing up using the Vulert playground.
