Critical Malicious Code Vulnerability in tronlinknet Package - Key Exfiltration Risk
Summary
MAL-2025-191912: Malicious code in tronlinknet (PyPI). Affects tronlinknet versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tronlinknet package, available on PyPI, is purportedly designed for cryptocurrency-related functionalities, particularly associated with TRX (Tron/Tronix). However, it has been identified as a malicious package aimed at exfiltrating private keys. The package has been observed to clone the README files of legitimate libraries, raising concerns about its authenticity and intent.
Vulnerability Detail
The vulnerability stems from the malicious intent behind the tronlinknet package, which is designed for private key exfiltration. This poses a significant risk to users, especially those involved in cryptocurrency transactions, as it can lead to unauthorized access to sensitive information. The package is part of a broader campaign identified as '2025-04-tronix', which includes various similar malicious uploads to PyPI. The technical aspects involve the use of domains that may facilitate data exfiltration, making it crucial for users to be aware of the potential ramifications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tronlinknetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the tronlinknet package altogether. If you have dependencies that require it, consider looking for alternative packages that provide similar functionality without the associated risks.
Conclusion
The tronlinknet package poses a significant risk due to its malicious intent aimed at private key exfiltration. Users should take immediate action to remove this package and consider alternatives to safeguard their cryptocurrency assets. Monitoring tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for tronlinknet →
FAQ
The tronlinknet package is a Python library available on PyPI, which is associated with cryptocurrency functionalities but has been identified as malicious.
The vulnerability can lead to the exfiltration of your private keys, potentially allowing unauthorized access to your cryptocurrency assets.
You should uninstall the tronlinknet package immediately using the command 'pip uninstall tronlinknet'.
Yes, consider using other legitimate libraries that provide similar functionalities without the associated risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground at Vulert Scanner without any signup.
