Malicious Code Exfiltration in testcatplzignore Package
Summary
MAL-2025-191893: Malicious code in testcatplzignore (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The testcatplzignore package is a Python package available on the Python Package Index (PyPI). It is designed for testing purposes, but it has been found to contain malicious code. This code is specifically crafted to exfiltrate basic information from the host system, such as the user's IP address and username, making it a potential security risk for users who install it.
Vulnerability Detail
The vulnerability originates from the malicious code embedded within the testcatplzignore package. Upon installation or import of the module, it executes code that collects and sends sensitive information from the host system to an external source. The package overrides the install command in setup.py, ensuring that this malicious code runs during the installation process. This poses a risk to users as it can lead to unauthorized data exposure without their consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall testcatplzignoreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the testcatplzignore package altogether. If you need similar functionality, consider using alternative packages that are well-reviewed and have a good security track record. Always verify the source and integrity of packages before installation.
Conclusion
The testcatplzignore package poses a significant security risk due to its malicious code that exfiltrates sensitive information from users' systems. It is crucial to uninstall this package and avoid using unverified packages from PyPI. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for testcatplzignore →
FAQ
The testcatplzignore package is intended for testing purposes but contains malicious code that exfiltrates user information.
You can check your installed packages by running 'pip list' in your terminal and looking for 'testcatplzignore'.
The malicious code collects basic information such as the user's IP address and username.
No patch is available for the testcatplzignore package as it is inherently malicious. The best course of action is to uninstall it.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for testcatplzignore.
