Malicious Code Exfiltration in tcloud-python-sdks Package
Summary
MAL-2025-191887: Malicious code in tcloud-python-sdks (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tcloud-python-sdks package is a Python library designed for interacting with various cloud services. It allows developers to easily integrate cloud functionalities into their applications. However, this package has been compromised, leading to significant security vulnerabilities that can expose sensitive user credentials to malicious actors.
Vulnerability Detail
The vulnerability originates from a malicious campaign that has been active for at least two years. The campaign involves packages that appear innocuous, such as 'time-check-server' and 'snapshot-photo', which send date information to a remote server. More critically, the 'alicloud-client' package is a clone of a legitimate package but has been altered to exfiltrate cloud credentials instead of harmless data. This malicious behavior poses a severe risk to users, as their cloud tokens and sensitive information can be stolen without their knowledge.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tcloud-python-sdksIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tcloud-python-sdks package until a secure version is confirmed. Additionally, consider using alternative libraries that provide similar functionalities without the associated risks.
Conclusion
The tcloud-python-sdks package has been compromised, leading to serious security vulnerabilities that can expose sensitive user information. It is essential to update the package and monitor your applications for any signs of compromise. Utilizing tools like Vulert can help in identifying and mitigating such risks effectively.
See every vulnerability recorded for tcloud-python-sdks →
FAQ
The package contains malicious code that can exfiltrate sensitive cloud credentials to unauthorized servers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have used the compromised package, it is recommended to change your cloud credentials immediately and update the package to the latest version.
Yes, the domains 'checktimeserver.org' and 'aliyun-sdk-requests.xyz' are associated with the malicious activities of this vulnerability.
Always verify the integrity of packages before use, keep your dependencies updated, and monitor for vulnerabilities using tools like Vulert.
