Critical Malicious Code Vulnerability in ziphash Package
Summary
MAL-2026-6: Malicious code in ziphash (PyPI). Affects ziphash versions 0.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ziphash package, available on PyPI, is designed to facilitate the handling of zip archives in Python applications. It provides functionalities for reading and writing zip files, making it a useful tool for developers working with compressed data. However, the package has been identified to contain malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from the initialization process of the archive-support class within the ziphash package. During this process, the package executes code from an external file, which leads to the downloading and execution of multi-stage malware. This malicious activity can result in severe consequences, including unauthorized access to sensitive data, system compromise, and the installation of additional malware. The campaign associated with this vulnerability has been categorized as malicious due to its intent to steal information and obfuscate its operations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall ziphashIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the ziphash package until a secure version is released. Additionally, consider using alternative libraries for handling zip files, such as the built-in 'zipfile' module in Python, which does not exhibit this vulnerability.
Conclusion
The ziphash package contains a critical vulnerability that allows for the execution of malicious code, posing significant risks to users. It is essential to update or remove the package and consider alternatives until a secure version is available. Monitoring tools like Vulert can aid in identifying vulnerabilities in your applications.
See every vulnerability recorded for ziphash →
FAQ
ziphash is a Python package used for handling zip archives, allowing developers to read and write compressed files easily.
The vulnerability is classified as malicious, involving the execution of external code that downloads malware.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If you have installed ziphash, it is recommended to uninstall it immediately and monitor for updates or patches.
Yes, you can use Python's built-in 'zipfile' module as a secure alternative for handling zip files.
