Exfiltration Vulnerability in spark-audit-notify Package
Summary
MAL-2026-1019: Malicious code in spark-audit-notify (PyPI). Affects spark-audit-notify versions 1.30 – 1.32. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spark-audit-notify package, available on PyPI, is designed for auditing and notification purposes within Spark applications. It allows users to monitor and log activities effectively. However, this package has been found to contain malicious code that compromises user data during installation, making it a significant security concern.
Vulnerability Detail
The vulnerability originates from malicious code embedded in the spark-audit-notify package, specifically in versions 1.30, 1.31, and 1.32. During installation, the package overrides the install command in setup.py to execute code that exfiltrates sensitive host identification details, including the Active Directory (AD) domain, IP address, and username. This obfuscation of behavior poses a risk to user privacy and system security, as it allows unauthorized access to potentially sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall spark-audit-notifyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the spark-audit-notify package until a secure version is released. Additionally, ensure that your environment is monitored for any unauthorized data exfiltration during the installation of packages.
Conclusion
The spark-audit-notify package contains a serious vulnerability that allows for the exfiltration of sensitive data during installation. Users are advised to update or remove the package to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for spark-audit-notify →
FAQ
The spark-audit-notify package is a tool for auditing and notification within Spark applications, allowing users to monitor activities.
The vulnerability involves malicious code that exfiltrates sensitive host identification details during installation, compromising user privacy.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed a vulnerable version, it is crucial to update the package to a patched version or remove it entirely until a secure version is available.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock, providing an efficient way to manage security.
