Malicious Code Vulnerability in sorex Package - Exfiltration of Credentials
Summary
MAL-2025-191873: Malicious code in sorex (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sorex package, available on PyPI, is designed to facilitate interactions with Aminoapps, a platform for social networking. It is intended for developers looking to integrate Amino functionalities into their applications. However, the package has been compromised, leading to significant security concerns due to the presence of malicious code that exfiltrates user credentials.
Vulnerability Detail
The vulnerability originates from a malicious actor who cloned the legitimate amino.fix package and embedded code that secretly exfiltrates user credentials. This malicious code is triggered during the normal usage of the library, making it difficult for users to detect. The implications of this vulnerability are severe, as it can lead to unauthorized access to user accounts and data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall sorexIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the sorex package until a secure version is released. Additionally, consider using alternative libraries that provide similar functionalities without the associated risks.
Conclusion
The sorex package has been identified as containing malicious code that exfiltrates user credentials. Users are advised to uninstall the package and monitor for updates or alternatives. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for sorex →
FAQ
The sorex package is a Python library designed to interact with Aminoapps, enabling developers to integrate Amino functionalities into their applications.
The vulnerability allows malicious code to exfiltrate user credentials, potentially leading to unauthorized access to user accounts and sensitive data.
If you have installed sorex, you should uninstall it immediately and refrain from using it until a secure version is released.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, consider using other libraries that provide similar functionalities to Aminoapps without the security risks associated with sorex.
