Malicious Code Exfiltration in tclients-sdk: A Critical Vulnerability
Summary
MAL-2025-191886: Malicious code in tclients-sdk (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tclients-sdk is a Python package available on PyPI, designed to facilitate interactions with cloud services. However, it has been compromised by malicious actors who have embedded code that exfiltrates sensitive user credentials to remote servers. This vulnerability poses significant risks to users relying on this package for secure cloud operations.
Vulnerability Detail
The vulnerability originates from a malicious campaign that has been active for at least two years. It involves packages masquerading as legitimate services, such as 'time-check-server' and 'snapshot-photo', which appear harmless but are designed to send sensitive information, including cloud credentials, to unauthorized remote servers. The malicious code is hidden within the dependency of the package, making it difficult for users to detect. The campaign has been identified as targeting users of cloud services, specifically those using the alicloud-client and AWS clients.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tclients-sdkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the tclients-sdk package until a secure version is confirmed. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The tclients-sdk package has been compromised by malicious actors, leading to a significant vulnerability that exfiltrates sensitive user credentials. Users are advised to update their packages immediately and consider alternative solutions to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tclients-sdk →
FAQ
The vulnerability involves malicious code that exfiltrates sensitive user credentials to remote servers, disguised within seemingly innocent packages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed the compromised version, you should immediately update to the latest patched version using pip install --upgrade tclients-sdk.
Yes, consider using other reputable packages that provide similar functionalities without the associated risks of malicious code.
Ensure you are using secure and trusted packages, regularly update your dependencies, and monitor your applications for any suspicious activity.
