Malicious Code Vulnerability in torchflow-experimental Package
Summary
MAL-2025-191907: Malicious code in torchflow-experimental (PyPI). Affects torchflow-experimental versions 0.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The torchflow-experimental package is a Python library available on PyPI, designed for experimental features related to the PyTorch framework. It aims to provide users with tools for deep learning and machine learning experiments. However, this package has been identified to contain malicious code that compromises user data and system integrity.
Vulnerability Detail
The vulnerability originates from the package's design, which includes code that exfiltrates sensitive information such as the host's IP address and username upon installation or import. This malicious behavior is executed through an overridden install command in the setup.py file, allowing it to run arbitrary code during the installation process. The risk is categorized as low, but it still poses a threat to user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall torchflow-experimentalIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the torchflow-experimental package until a secure version is released. If you need similar functionality, consider using alternative packages that are well-reviewed and have no known vulnerabilities.
Conclusion
The torchflow-experimental package has been identified as containing malicious code that compromises user data. Users are strongly advised to uninstall the package and monitor for updates or alternatives that ensure security. Utilizing tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for torchflow-experimental →
FAQ
The malicious code exfiltrates basic information about the host, including the IP address and username, without the user's consent.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Uninstall the torchflow-experimental package immediately using 'pip uninstall torchflow-experimental' and look for alternative packages.
Yes, using this package can lead to unauthorized access to your personal information and compromise your system's security.
Currently, there is no patched version available. Users are advised to uninstall the package and seek alternatives.
