Malicious Code Detected in urlssser Package - PyPI Vulnerability Alert
Summary
MAL-2026-326: Malicious code in urlssser (PyPI). Affects urlssser versions 0.1 – 0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The urlssser package, available on the Python Package Index (PyPI), is designed to assist users in URL shortening and management. However, it has been identified as part of a malicious campaign, specifically the '2025-10-speedd-testing-bot', which exploits its functionality to execute harmful scripts. This vulnerability poses significant risks to users who may unknowingly install the package, leading to potential data theft and system compromise.
Vulnerability Detail
The vulnerability originates from the urlssser package being uploaded as part of a malicious campaign. Although the package itself does not contain direct malicious code, it serves as a helper for further infection stages. The campaign employs techniques such as typosquatting, where users may mistakenly install the malicious package instead of a legitimate one. Once installed, it downloads and executes remote malicious scripts, potentially leading to unauthorized access and control over the user's system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall urlssserIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can monitor their systems for any unauthorized activities and ensure that they do not install packages from unverified sources. Additionally, employing security tools to scan for malicious scripts can help mitigate risks.
Conclusion
The urlssser package has been identified as part of a malicious campaign that poses significant risks to users. It is crucial to uninstall the package and monitor for any unauthorized activities. Utilizing tools like Vulert can help keep your software secure against such vulnerabilities.
See every vulnerability recorded for urlssser →
FAQ
urlssser is a Python package designed for URL shortening and management, but it has been compromised in a malicious campaign.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
Immediately uninstall the urlssser package using 'pip uninstall urlssser' and avoid using it until a safe version is released.
The risks include unauthorized access to your system, data theft, and potential control over your device by malicious actors.
Always verify the source of packages before installation, use security tools to scan for vulnerabilities, and keep your software updated.
