Malicious Code Execution Vulnerability in snap-queue Package
Summary
MAL-2026-16408: Malicious code in snap-queue (PyPI). Affects snap-queue versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The snap-queue package, available on PyPI, is designed to provide FIFO-queue functionality for Python applications. However, it has been identified to contain malicious code that executes during installation, compromising user systems. This vulnerability arises from the package's setup.py file, which includes a function that runs automatically, leading to potential security risks.
Vulnerability Detail
The vulnerability originates from the setup.py file of the snap-queue package, which defines a function that executes malicious code upon installation. This function uses subprocess.Popen to launch an undocumented sibling file, _snapqueue_core.py, which is unrelated to the intended functionality of the package. The execution occurs silently, suppressing any console output and errors, thus allowing the malicious code to run unnoticed. This behavior poses significant risks, including unauthorized access to the installer's machine and potential data theft.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall snap-queueIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid installing the snap-queue package until a secure version is available. Additionally, consider using virtual environments to isolate dependencies and minimize risks.
Conclusion
The snap-queue package has been identified as containing malicious code that executes during installation, posing significant security risks. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for snap-queue →
FAQ
The snap-queue package is a Python library designed to implement FIFO-queue functionality in applications.
The vulnerability allows malicious code to execute silently during installation, potentially compromising your system's security.
Uninstall the snap-queue package immediately and monitor your system for any unusual activity.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
It is expected that the maintainers will release a patched version. Keep an eye on the package's PyPI page for updates.
