Malicious Code Vulnerability in time-check-server Package
Summary
MAL-2025-191900: Malicious code in time-check-server (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The time-check-server package, available on PyPI, is designed to provide time-checking functionalities. However, it has been compromised by malicious actors who have embedded code that exfiltrates sensitive information. This package is part of a broader campaign that includes other similarly named packages, which raises concerns about the integrity of dependencies in Python projects.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the time-check-server package. This code sends sensitive data, such as cloud credentials, to a remote server. The malicious functionality was introduced in a campaign that has been active for at least two years, with the time-check-server package being a recent addition. The code's design allows it to operate stealthily, making it difficult for users to detect its presence and the data exfiltration it performs.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall time-check-serverIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the time-check-server package and consider alternative libraries that provide similar functionalities without the associated risks. Additionally, regularly audit your dependencies to ensure no malicious packages are included.
Conclusion
The time-check-server package has been compromised with malicious code that poses a significant risk to users by exfiltrating sensitive information. It is essential to remove this package and monitor your dependencies for any similar threats. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for time-check-server →
FAQ
The time-check-server package is a Python library intended for time-checking functionalities, but it has been compromised to exfiltrate sensitive information.
The malicious code sends sensitive data, such as cloud credentials, to a remote server, making it a significant security risk.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have used the time-check-server package, it is recommended to remove it immediately and replace it with a secure alternative.
Yes, other packages with similar names, such as snapshot-photo and alicloud-client, have also been identified as part of the same malicious campaign.
