Critical Malicious Code Vulnerability in bitcoinlib-dev Package
Summary
MAL-2025-3436: Malicious code in bitcoinlib-dev (PyPI). Affects bitcoinlib-dev versions 0.4.16 – 0.4.21. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bitcoinlib-dev package is a Python library designed for working with Bitcoin and other cryptocurrencies. It provides a comprehensive set of tools for developers to create, manage, and interact with Bitcoin wallets and transactions. However, recent findings have revealed that certain versions of this package contain malicious code, posing significant security risks to applications that rely on it.
Vulnerability Detail
The vulnerability identified in bitcoinlib-dev stems from the presence of malicious code within specific versions of the package. This code can potentially compromise the integrity of applications using the library, leading to unauthorized access, data breaches, or other malicious activities. The affected versions include 0.4.16 through 0.4.21, and the issue was reported by ReversingLabs, highlighting the importance of vigilance in package management.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall bitcoinlib-devIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider isolating the affected package or using an alternative library that provides similar functionality without the associated risks. Additionally, you can monitor your application for any suspicious activity while planning for an upgrade.
Conclusion
The bitcoinlib-dev package has been found to contain malicious code in several versions, posing serious security risks to applications that utilize it. It is essential for developers to update to a secure version promptly and consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for bitcoinlib-dev →
FAQ
The affected versions include 0.4.16, 0.4.17, 0.4.18, 0.4.19, 0.4.20, and 0.4.21.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Consider isolating the affected package or using an alternative library while monitoring your application for any suspicious activity.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat intelligence.
Using the affected versions can lead to unauthorized access, data breaches, and other malicious activities that compromise the security of your application.
