Malicious Code Exfiltration in socketxio Package
Summary
MAL-2026-1084: Malicious code in socketxio (PyPI). Affects socketxio versions 1.5 – 2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The socketxio package, available on PyPI, is designed for socket communication in Python applications. It allows developers to implement real-time features in their applications, such as chat functionalities or live updates. However, a recent vulnerability has been identified that compromises user credentials, specifically Discord tokens, through malicious code embedded in the package.
Vulnerability Detail
The vulnerability originates from a malicious actor who introduced code into the socketxio package that exfiltrates Discord tokens to a hardcoded location. This poses a significant risk as it can lead to unauthorized access to user accounts and sensitive information. The malicious code is executed when users utilize the affected functions of the library, making it a hidden threat that can easily go unnoticed by developers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall socketxioIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functions of the socketxio package until the package is updated. Additionally, consider using alternative libraries for socket communication that do not have known vulnerabilities.
Conclusion
The socketxio package has been compromised with malicious code that exfiltrates sensitive Discord tokens. Users are urged to update to the latest version to protect their applications from potential breaches. Monitoring tools like Vulert can assist in identifying such vulnerabilities in real-time.
See every vulnerability recorded for socketxio →
FAQ
The socketxio package is used for implementing socket communication in Python applications, enabling real-time features like chat and live updates.
The vulnerability allows malicious code to exfiltrate Discord tokens, potentially leading to unauthorized access to user accounts and sensitive information.
If you have installed versions 1.5 to 2.1 of socketxio, you should immediately update to version 2.2 or later to mitigate the risk.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground.
Detailed information about this vulnerability can be found on the official GitHub repository and vulnerability databases that track malicious packages.
