Malicious Code Vulnerability in scraper-npm: Exfiltration and Backdoor Risk
Summary
MAL-2026-1000: Malicious code in scraper-npm (PyPI). Affects scraper-npm versions 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scraper-npm package, available on PyPI, is designed for web scraping tasks. It allows users to extract data from websites efficiently. However, this package has been identified as malicious, containing code that poses significant security risks, including unauthorized file access and backdoor creation.
Vulnerability Detail
The vulnerability originates from the malicious code embedded in the scraper-npm package, specifically version 1.0.4. Upon import, the package exfiltrates sensitive files, such as .env and JSON files, and establishes a backdoor by adding its SSH key to the authorized_keys file. This could lead to unauthorized access to the system and potential data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall scraper-npmIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the scraper-npm package until a secure version is released. Additionally, monitor your system for any unauthorized SSH keys and remove them if found.
Conclusion
The scraper-npm package has been identified as malicious, posing significant risks through file exfiltration and backdoor creation. Users are advised to uninstall the package and monitor their systems for any unauthorized access. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source packages.
See every vulnerability recorded for scraper-npm →
FAQ
The primary risk is unauthorized access to sensitive files and potential system compromise due to the backdoor created by the malicious code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Immediately uninstall the affected version of scraper-npm and check for any unauthorized changes to your system.
Yes, the malicious code specifically targets files such as .env and JSON files for exfiltration.
Currently, there is no patched version available. It is recommended to uninstall the package until a secure version is released.
