Malicious Code Injection in smtmlib Package - Remote Code Execution Vulnerability
Summary
MAL-2025-192958: Malicious code in smtmlib (PyPI). Affects smtmlib versions 0.1.6 – 0.1.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The smtmlib package, available on PyPI, is designed to provide functionalities similar to standard library modules. However, it has been compromised by a malicious actor, leading to severe security risks. The package has been found to contain code that downloads and executes remote scripts, posing a significant threat to users, particularly those using Telegram.
Vulnerability Detail
The vulnerability originates from a malicious copy of a standard library module within the smtmlib package. During the initialization of a class, this malicious code downloads and executes remote scripts aimed at collecting sensitive information, specifically targeting Telegram session files. After executing the malicious code, it attempts to erase its tracks by replacing itself with non-malicious code. This infostealer behavior is part of a broader campaign that shares infrastructure with previous malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall smtmlibIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid using the smtmlib package until it has been updated to a secure version. Additionally, consider using alternative libraries that provide similar functionalities without the associated risks.
Conclusion
The smtmlib package has been compromised, leading to a serious vulnerability that allows remote code execution and data exfiltration. Users are strongly advised to update to the latest version or seek alternatives to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for smtmlib →
FAQ
The vulnerability involves malicious code that downloads and executes scripts from a remote server, compromising user data.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Pipfile.lock.
Using the compromised package can lead to the exfiltration of sensitive data, including Telegram session files, which can result in unauthorized access to user accounts.
The best mitigation strategy is to update to the latest patched version of smtmlib or to avoid using it until a secure version is available.
The vulnerability was reported by Kamil Mańkowski, who identified the malicious behavior within the smtmlib package.
