Malicious Code Exploit in snapshot-date Package: Exfiltration of Cloud Credentials
Summary
MAL-2026-610: Malicious code in snapshot-date (PyPI). Affects snapshot-date versions 1.0.0 – 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The snapshot-date package, available on PyPI, is designed to provide date-related functionalities. However, it has been compromised by malicious actors who have embedded code that can exfiltrate sensitive information. This vulnerability poses a significant risk to users who rely on this package for their applications, especially those integrating with cloud services.
Vulnerability Detail
The vulnerability originates from a malicious campaign that has been active for at least two years. It involves packages that appear innocuous, such as time-check-server and snapshot-photo, which send date information to a remote server. More critically, clones of legitimate packages, like alicloud-client, have been modified to import these malicious packages and exfiltrate cloud credentials instead of just date information. This poses a severe risk as it can lead to unauthorized access to cloud accounts and sensitive data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall snapshot-dateIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the snapshot-date package from your project and replacing it with a trusted alternative that does not have known vulnerabilities. Ensure to audit your dependencies regularly to avoid similar issues.
Conclusion
The snapshot-date package has been compromised, leading to a significant vulnerability that can exfiltrate sensitive cloud credentials. It is crucial for users to update their packages or remove them entirely to safeguard their applications. Regular monitoring of dependencies is essential to prevent similar issues in the future.
See every vulnerability recorded for snapshot-date →
FAQ
The snapshot-date package is a Python package available on PyPI that provides functionalities related to date handling.
The vulnerability can lead to the exfiltration of sensitive cloud credentials, potentially allowing unauthorized access to your cloud services.
You should immediately update the package to the latest version or remove it from your project and replace it with a secure alternative.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground without needing to sign up.
Detailed information can be found in the vulnerability report on GitHub or by checking the package's page on PyPI.
