Malicious Code Exfiltration in time-server-analysis Package
Summary
MAL-2025-191902: Malicious code in time-server-analysis (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The time-server-analysis package is a Python library available on PyPI that is intended for analyzing time server responses. However, it has been compromised by malicious actors who have embedded code that exfiltrates sensitive information. This vulnerability is particularly concerning as it targets users' cloud credentials, posing a significant risk to data security.
Vulnerability Detail
The vulnerability originates from a campaign that has been active for at least two years, involving packages that masquerade as legitimate libraries. Specifically, the time-server-analysis package contains code that sends sensitive data, such as cloud credentials, to remote servers. The malicious code is hidden within dependencies, making it difficult for users to detect. The campaign includes clones of legitimate packages, which further complicates the issue. Users of this package are at risk of having their credentials exposed to attackers, leading to potential unauthorized access to their cloud services.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall time-server-analysisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the time-server-analysis package and look for alternative libraries that provide similar functionality without the associated risks. Additionally, consider implementing network monitoring to detect any unauthorized data exfiltration.
Conclusion
The time-server-analysis package has been compromised, leading to significant security risks for users. It is crucial to update the package or switch to alternatives to protect sensitive information. Regular monitoring and awareness of vulnerabilities are essential for maintaining software security.
See every vulnerability recorded for time-server-analysis →
FAQ
It is a Python library designed for analyzing responses from time servers, but it has been compromised with malicious code.
The malicious code sends sensitive information, such as cloud credentials, to remote servers without the user's knowledge.
Immediately update the package to the latest version or remove it and switch to a safer alternative.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software without requiring access to the code or installation.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without signing up.
