Malicious Code Vulnerability in trondec Package - Key Exfiltration Risk
Summary
MAL-2025-192605: Malicious code in trondec (PyPI). Affects trondec versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The trondec package, available on PyPI, is purportedly designed for cryptocurrency-related functionalities. However, it has been identified as a potential threat due to its capability for private key exfiltration. The package has been associated with malicious campaigns that aim to compromise user data, particularly in the cryptocurrency domain. Its name suggests a connection to the TRX cryptocurrency, which may mislead users into trusting its legitimacy.
Vulnerability Detail
The trondec package contains malicious code that is intended for the exfiltration of private keys. This vulnerability originated from a malicious actor identified as kam193, who uploaded the package to PyPI. The ramifications of this vulnerability include unauthorized access to sensitive information, particularly for users involved in cryptocurrency transactions. The package has been linked to a broader campaign targeting crypto-related applications, raising concerns about the security of similar packages on the platform.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall trondecIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should refrain from using the trondec package and consider alternative libraries that do not pose security risks. Additionally, regularly monitor your environment for any unauthorized access or anomalies.
Conclusion
The trondec package poses a significant security risk due to its malicious intent for private key exfiltration. Users are advised to uninstall the package and seek alternatives to safeguard their sensitive information. Regular monitoring for vulnerabilities is essential to maintain the security of applications.
See every vulnerability recorded for trondec →
FAQ
The trondec package is a Python library that appears to be related to cryptocurrency functionalities but has been identified as malicious.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
If you have installed trondec, you should uninstall it immediately using the command 'pip uninstall trondec'.
Yes, consider using other reputable libraries that provide similar functionalities without the associated risks.
Vulert uses Pipfile.lock to monitor and alert in real-time for open-source vulnerabilities in your software, helping you maintain security.
