Malicious Code Exfiltration in wandb-widget Package
Summary
MAL-2026-620: Malicious code in wandb-widget (PyPI). Affects wandb-widget versions 0.0.0 – 0.1.0a0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wandb-widget package, available on PyPI, is designed for integrating with Weights & Biases, a popular tool for tracking machine learning experiments. It allows users to visualize and manage their experiments efficiently. However, this package has been compromised, leading to a significant security vulnerability that can exfiltrate sensitive information from the host system.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the wandb-widget package. Upon installation or import, this code exfiltrates basic information about the host, such as the IP address and username. The package overrides the install command in setup.py, executing this malicious code during the installation process. This poses a risk as it can lead to unauthorized access to sensitive data, although the immediate risk is considered limited.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall wandb-widgetIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the wandb-widget package until a patched version is released. If you need similar functionality, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The wandb-widget package has been compromised, leading to a vulnerability that allows for the exfiltration of sensitive information from the host system. Users are advised to uninstall the affected versions and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for wandb-widget →
FAQ
The wandb-widget package is a tool for integrating with Weights & Biases, allowing users to visualize and manage machine learning experiments.
The malicious code exfiltrates basic information such as the host's IP address and username.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed the wandb-widget package, you should uninstall it immediately and check for any updates or patches.
While the immediate risk is limited, the exfiltration of sensitive information can lead to unauthorized access, which poses a potential risk to data security.
