Malicious Code Detected in troncloud Package: Key Exfiltration Risk
Summary
MAL-2026-894: Malicious code in troncloud (PyPI). Affects troncloud versions 0.0.1 – 0.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The troncloud package, available on PyPI, is purportedly designed for cryptocurrency-related functionalities, specifically associated with TRX (Tron / Tronix). However, it has been identified as a malicious package aimed at private key exfiltration. The package has been observed to clone readme files from legitimate libraries, raising concerns about its authenticity and intent. Users should be cautious as similar malicious packages have been repeatedly uploaded to PyPI.
Vulnerability Detail
The vulnerability in the troncloud package originates from its design, which is intended for exfiltrating private keys. This poses a significant risk to users, especially those involved in cryptocurrency transactions, as it can lead to unauthorized access to sensitive information. The malicious nature of the package is confirmed by its association with a campaign aimed at stealing information, specifically targeting crypto-related data. The package has been linked to multiple versions that exhibit this malicious behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall troncloudIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there are no safe versions of the troncloud package, the only workaround is to avoid using it altogether. Users should look for alternative packages that provide similar functionalities without the associated risks.
Conclusion
The troncloud package has been identified as a malicious tool designed for private key exfiltration, posing serious risks to users, particularly in the cryptocurrency domain. Immediate action is required to uninstall this package and seek safer alternatives.
See every vulnerability recorded for troncloud →
FAQ
The troncloud package is a Python library available on PyPI, which is purportedly related to cryptocurrency functionalities, specifically for TRX (Tron / Tronix).
The troncloud package is designed for private key exfiltration, posing a significant risk to users by potentially stealing sensitive information related to cryptocurrency.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
If you have installed troncloud, you should uninstall it immediately using the command 'pip uninstall troncloud' and avoid using any versions of this package.
Yes, users should look for alternative packages that provide similar functionalities without the associated risks of malicious intent.
