Malicious Code Vulnerability in spark-ml-utilities: Remote Code Execution Risk
Summary
MAL-2026-1224: Malicious code in spark-ml-utilities (PyPI). Affects spark-ml-utilities versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
spark-ml-utilities is a Python package available on PyPI that provides utilities for machine learning tasks. It is designed to simplify the use of Spark's MLlib for Python developers. However, a recent vulnerability has been discovered that allows malicious actors to execute remote code during installation, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2026-02-urllib-slim'. The affected package contains obfuscated code that, upon installation, downloads and executes remote executables. This behavior is indicative of infostealers, as it attempts to exfiltrate user information through DNS requests. Additionally, it may install a similarly named package from a private repository to cover its tracks. The malicious code is present in versions 1.0.0 and 1.0.1 of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall spark-ml-utilitiesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the affected versions (1.0.0 and 1.0.1) of spark-ml-utilities. Instead, consider using alternative packages or earlier versions that do not contain the malicious code.
Conclusion
The spark-ml-utilities package has been identified as containing malicious code that poses significant security risks. Users are advised to update to a secure version and utilize monitoring tools like Vulert to stay informed about potential vulnerabilities.
See every vulnerability recorded for spark-ml-utilities →
FAQ
The vulnerability involves malicious code that executes remote commands during installation, potentially compromising user systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed versions 1.0.0 or 1.0.1, it is crucial to uninstall them immediately and update to a secure version of the package.
The risks include unauthorized access to sensitive information, potential system compromise, and the installation of additional malicious software.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, and ensure to install packages from trusted sources.
