Malicious Code Injection in testingpy: A Serious Threat to Users
Summary
MAL-2026-99: Malicious code in testingpy (PyPI). Affects testingpy versions 0.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'testingpy' is a Python library available on PyPI, designed to provide testing utilities for Python applications. However, it has been compromised by malicious actors who cloned a legitimate library and embedded harmful code. This vulnerability exposes users to significant risks, including data theft and unauthorized access to their systems.
Vulnerability Detail
The vulnerability originates from a malicious update to the 'testingpy' package, which was cloned from a legitimate library. The malicious code downloads an executable script that acts as an infostealer and backdoor, attributed to North Korean cybercrime activities. This code not only steals sensitive information but also modifies the original library to collect cryptographic keys, ensuring persistence by creating auto-start service entries. The attack is characterized by typosquatting, obfuscation, and hidden actions within library usage.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall testingpyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using 'testingpy' until the package is verified as safe. Additionally, consider using alternative testing libraries that are well-known and have a good reputation in the community.
Conclusion
The 'testingpy' package has been compromised, posing serious risks to users through malicious code that steals information and creates backdoors. Immediate action is required to uninstall the package and replace it with a legitimate alternative. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for testingpy →
FAQ
Testingpy is a Python library designed to assist developers in writing and executing tests for their applications.
The package was cloned from a legitimate library, and malicious code was added in an update, which downloads harmful scripts.
The risks include data theft, unauthorized access to sensitive information, and potential system compromise through backdoor access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Uninstall 'testingpy' immediately and replace it with a legitimate package. Use 'pip uninstall testingpy' followed by 'pip install <legitimate-package-name>'.
