Malicious Code Exfiltration in tokyo-ppe-test Package
Summary
MAL-2026-699: Malicious code in tokyo-ppe-test (PyPI). Affects tokyo-ppe-test versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tokyo-ppe-test package is a Python library available on PyPI, designed for testing and exploration purposes. However, it has been identified as containing malicious code that exfiltrates sensitive information from the host system. This package is particularly concerning as it overrides the installation command to execute harmful actions during the installation process.
Vulnerability Detail
The vulnerability originates from the tokyo-ppe-test package, which contains code that exfiltrates basic information such as the host's IP address and username. This malicious behavior is triggered upon installation, as the package overrides the install command in setup.py to execute the harmful code. The risk is categorized as limited, but it poses a significant threat to users who unknowingly install the package, as it compromises their system's security and privacy.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tokyo-ppe-testIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid installing the tokyo-ppe-test package altogether. If the package is already installed, it can be removed using the command: 'pip uninstall tokyo-ppe-test'.
Conclusion
The tokyo-ppe-test package poses a significant security risk due to its malicious code that exfiltrates sensitive information from users' systems. Immediate action is required to uninstall the package and monitor for any potential impacts. Users are encouraged to utilize tools like Vulert to stay informed about vulnerabilities in their software.
See every vulnerability recorded for tokyo-ppe-test →
FAQ
The tokyo-ppe-test package is intended for testing and exploration, but it has been found to contain malicious code that exfiltrates user information.
If you have installed the tokyo-ppe-test package, your system may have been affected. Check for any unusual behavior or data exfiltration.
Currently, there is no safe version of the tokyo-ppe-test package available. It is recommended to uninstall it immediately.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using Pipfile.lock. Check your application for vulnerabilities at Vulert Scanner.
If you have installed the tokyo-ppe-test package, uninstall it immediately using 'pip uninstall tokyo-ppe-test' and monitor your system for any unusual activity.
