Malicious Code Exfiltration in umap Package - PyPI Vulnerability
Summary
MAL-2025-192992: Malicious code in umap (PyPI). Affects umap versions 0.0.0 – 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The umap package, available on PyPI, is designed for dimensionality reduction and data visualization. However, it has been compromised to include malicious code that exfiltrates sensitive information from the host system. The package has no legitimate functionality beyond this malicious intent, making it a significant risk for users who install it.
Vulnerability Detail
The vulnerability originates from the package's code, which is designed to exfiltrate basic information such as the host's IP address and username upon installation. This is achieved by overriding the install command in the setup.py file, allowing the execution of malicious code during the installation process. The risk is categorized as low, but it poses a threat to user privacy and system security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall umapIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually check their Pipfile.lock for any references to the umap package and remove it to prevent accidental installation. Additionally, consider using a virtual environment to isolate dependencies and mitigate risks.
Conclusion
The umap package has been identified as malicious, with the potential to exfiltrate sensitive information from users' systems. It is crucial to uninstall the affected versions and monitor for any signs of compromise. Users are encouraged to utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for umap →
FAQ
The umap package is a Python library used for dimensionality reduction and data visualization, but it has been compromised to include malicious code.
The vulnerability allows the package to exfiltrate sensitive information such as your IP address and username without your consent.
You should uninstall the umap package immediately and check for any signs of data exfiltration on your system.
Yes, consider using other reputable libraries for dimensionality reduction, such as scikit-learn or t-SNE, which do not have known vulnerabilities.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
