Critical Malicious Code Vulnerability in uzip Package
Summary
MAL-2025-191919: Malicious code in uzip (PyPI). Affects uzip versions 0.1.0 – 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uzip package, available on PyPI, is designed for handling archive files in Python applications. It provides functionalities to create and extract compressed files, making it a useful tool for developers working with file management. However, recent findings have revealed a significant vulnerability that allows malicious code execution during the initialization of the archive-support class.
Vulnerability Detail
The uzip package contains malicious code that executes during the initialization phase of its archive-support class. This code downloads multi-stage malware from a remote server, posing a severe threat to users. The vulnerability originates from a specific commit by the package maintainer, kam193, and affects versions 0.1.0 and 0.1.1. The malicious behavior includes downloading and executing a remote executable, employing obfuscation techniques to hide its true intent, and potentially compromising user data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall uzipIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the uzip package until a secure version is confirmed. If you need to handle archive files, consider using alternative packages that do not exhibit this vulnerability.
Conclusion
The uzip package has a critical vulnerability that allows for the execution of malicious code, posing a significant risk to users. It is crucial to update to the latest version or find alternative solutions to mitigate this threat. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for uzip →
FAQ
uzip is a Python package used for creating and extracting archive files, facilitating file management in Python applications.
The vulnerability allows malicious code to be executed, which can lead to data theft, unauthorized access, or system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, refrain from using the uzip package until a secure version is available, and consider alternative packages for handling archives.
The vulnerability was introduced by the package maintainer, kam193, and is documented in the malicious packages database.
