Critical Malicious Code Vulnerability in yzip Package
Summary
MAL-2025-192468: Malicious code in yzip (PyPI). Affects yzip versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yzip package, available on PyPI, is designed for handling archive files. It provides functionalities for compressing and decompressing data. However, it has been found to contain a severe vulnerability that allows malicious code execution during its initialization phase, posing a significant risk to users.
Vulnerability Detail
The vulnerability originates from the package's initialization of the archive-support class, which inadvertently executes code from an external file. This leads to the download and execution of multi-stage malware, which can compromise user data and system integrity. The malicious code is designed to download and execute a remote executable, employing obfuscation techniques to evade detection. The campaign associated with this vulnerability has been categorized as malicious due to its intent to steal information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall yzipIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the yzip package until a secure version is released. Additionally, consider using alternative packages for archive handling that do not exhibit this vulnerability.
Conclusion
The yzip package has a critical vulnerability that allows for the execution of malicious code, posing significant risks to users. It is essential to monitor for updates and apply patches as they become available. Users should consider alternative solutions in the meantime to safeguard their systems.
See every vulnerability recorded for yzip →
FAQ
The vulnerability allows the execution of malicious code during the initialization of the package, leading to potential data theft and system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you are using yzip, it is recommended to stop using the package and monitor for updates. Once a patched version is available, update the package immediately.
Yes, consider using other archive handling packages that are known to be secure and do not have reported vulnerabilities.
Failure to address this vulnerability could lead to unauthorized access to sensitive data, system compromise, and potential exploitation by malicious actors.
